Security alerts by email (a copy that leaves this computer)

What it is

Omniscio raises alerts for security-relevant things — a key it could not unlock, a sign-in that went wrong, a device that was approved, a saved login that expired. Those arrive as cards in your inbox, which is a record kept on this computer.

This feature keeps a second copy somewhere else. The moment one of those alerts is raised, it is also emailed to your own address, from your own agent email address. If someone later deletes or edits what the app recorded here, the mailbox is still untouched.

The email is sent straight away and never slows the alert down or makes it fail: if mail cannot go out, your inbox card still appears exactly as it always would.

Where to find it

There is nothing to open. The emails arrive in your own mailbox at the address you used to sign in, sent from your agent email address, with a subject beginning Security alert —.

The switch that turns the whole thing off sits in Settings → Notifications → Security alerts by email, and it is on by default. Searching Settings for "security alert" finds it too.

How it behaves

• Each email carries the alert's title and its plain-English description, the date and time it was raised, the name of the computer it came from, and a link that opens the same alert in the app. Anything that looks like a password or an API key is hidden before the email is written — the same clean-up the inbox card already gets.
• At most one email per kind of alert per hour. If the same kind fires again inside that hour you do not get another email; the times it fired are counted, and the next email tells you how many. A brand-new alert is always sent immediately — only a repeat of one you are already being told about waits for the hour to pass.
• A daily ceiling of twenty. It applies to repeats of an alert you are already being told about, and one noisy condition cannot use up the day's email allowance. A genuinely new alert, or a retry of one that failed, is never held back by the ceiling.
• A failed send is retried, waiting a little longer each time, up to once an hour — and a pending email, its count and its retry streak survive closing and reopening the app.
• "Security alerts cannot leave this computer" appears when you have no agent email address yet, so there is nowhere for the copy to go. It carries a button that opens the screen where you set one up, it does not come back daily, and it clears itself the first time an email goes out.
• "Security alerts are not reaching your email" appears when sending has been failing for a full day. Nothing is wrong with the alerts themselves and Omniscio keeps trying; the card disappears by itself as soon as one email gets through.
• Turning it off stops the emails, the counting and both of those cards. Your security alerts are unaffected either way.
• What it does not do. It never emails you about ordinary, non-security alerts, it does not change or delay what your inbox shows, and it never sends anywhere except your own address.

For agents

The alert chokepoint (createAlert) calls forwardSecurityAlertOffMachine once per raise; the whole behaviour lives in src/main/services/security/security-alert-offsite-email.ts. Whether an alert leaves by email is decided from the alert type's registry category, never a list of keys. State (per-type window, folded counts, the daily counter, the failure streak) is a small JSON under ~/.amc/. Invariants: security-alert-offsite-email-contract.md.

Related

• Inbox alerts — the cards this mirrors off the machine.
• Inbox overview — the inbox they land in.