N°09 · Private tool · 2026 · Sign-in only
ScaledMail
Cold email I can pause, audit and stop: every follow-up waits for its window and cap, and stops the moment someone replies.
- Client
- Internal, my outreach
- Role
- Author
- Built with
- React 19, Express 5, Prisma + PostgreSQL, pg-boss, Nodemailer, ImapFlow
- Status
- Private · every data route needs my sign-in
- Live at
- Nowhere public to use. The dashboard sits behind my sign-in; the unsubscribe and email-tracking links work without it.

What it does
- 01
A send-safety state machine
Each message is committed before the SMTP call. Anything that can’t be confirmed is flagged for review, never re-sent automatically.
- 02
Replies stop the sequence
Any reply, even an out-of-office, stops that contact’s follow-ups. Unsubscribe is one click, and suppression is permanent.
- 03
Private by design
One owner, Argon2id passwords, 12-hour sessions, CSRF on every change, secrets encrypted at rest, live sending off by default.
The thing to see

Proof
- 7blockers checked before any send (suppressed, mailbox paused, sync stale, paused, campaign paused, outside window, quota limit)sending.ts
- 12 hsession lifetime; a second owner can’t be createdauth.ts
- 401what the dashboard’s data routes return to anyone not signed in as melive check, Oct 21 + server/app.ts
Reply, bounce and inbox-placement rates aren’t measured yet, so none are quoted.
On screen



Rendered from the real frontend fed synthetic data. The live dashboard sits behind my sign-in, and none of its data was used.