Apple's Year-Long Fix to Hide My Email Exposes Real Address Leakage in Mail Logs
Apple patched a flaw in Hide My Email that allowed real email addresses to be exposed in mail server logs, defeating the privacy feature's core purpose after remaining unfixed for over 12 months following responsible disclosure.
Affected
Apple's Hide My Email service, which generates masked email addresses to protect user privacy, contained a vulnerability where real addresses were written to mail server logs. This defeat of a privacy control represents a significant gap between the feature's advertised capability and actual behaviour. The real email address, once logged server-side, would be accessible to system administrators or in forensic logs, rendering the masking mechanism ineffective against infrastructure-level access.
The vulnerability persisted for over a year following disclosure by Tyler Murphy of EasyOptOuts in mid-2025, before Apple deployed a fix on 3 July 2026. This extended timeline raises questions about the prioritisation of privacy issues within Apple's security response process. While the company does maintain responsible disclosure practices, the delay suggests that privacy leaks may receive lower urgency prioritisation than availability or integrity vulnerabilities, or that the fix required architectural changes to logging pipelines.
The technical root cause likely stems from mail server logging occurring before or outside the masking abstraction layer, rather than at the application level. Hide My Email works by intercepting mail destined for masked addresses and forwarding to real addresses, but if this forwarding action is logged with both addresses intact, the real address becomes discoverable. This is a common anti-pattern when layering privacy controls over existing infrastructure built without privacy-first principles.
Users of Hide My Email should assume that their real addresses may have been logged on Apple's infrastructure during the vulnerable period. Organisations relying on this feature for threat reduction or operational security should review alternative masking services with stronger architectural guarantees about logging scope. Apple should publish details on whether logs were purged and what additional audit controls now exist to prevent similar leakage.
The incident underscores that privacy features require end-to-end design scrutiny, not just user-facing interface changes. A masking system is only as strong as its weakest logging surface. This pattern appears repeatedly in privacy-adjacent features across consumer tech, where frontend protections are undermined by backend systems designed before privacy requirements existed.
Sources