jiuwovo-ai/xiaopingguo

xiaopingguo, whose name means little apple in Chinese, is a self hosted tool for managing a large number of email accounts. It is built with Flask and PostgreSQL on the backend and reads mail through Microsoft's OAuth login and Graph API rather than storing raw email passwords in plain text. The README, written in Chinese, describes it as security focused, keeping account credentials on the server rather than in the browser. The main features let an administrator bulk import, view, update, delete, and stream export a list of email accounts. Passwords and OAuth refresh tokens for those accounts are stored encrypted, and the account list shown to a user only includes non sensitive details rather than the credentials themselves. The tool can read mail from these accounts, pull out verification codes, and detect messages from OpenAI's domain related to account verification. Security measures listed include database backed sessions, strict cookie settings, same origin checks, protection against cross site request forgery, and rate limiting on failed logins. The recommended production setup runs the Caddy web server in front of the app to handle HTTPS and security headers, with the actual Flask application run through Gunicorn listening only on the local loopback address rather than being exposed directly to the internet. Mailbox credentials are encrypted with a key called Fernet before being saved to PostgreSQL. Setting it up requires Python 3.12 or 3.13, PostgreSQL 17, and Node.js for the frontend tests, plus generating several secret keys for session handling, access control, and credential encryption. The README includes detailed instructions for running it as a systemd service under a dedicated non login system user, along with a backup process using pg_dump and a warning that losing the credential encryption key means the stored mailbox credentials cannot be recovered. This is a tool for someone who needs to manage many email accounts at once, likely for automated verification code retrieval, rather than a personal single inbox client. It is released under the GNU General Public License version 3.