Public story · 2026-07-02 · high
Apple's Hide My Email Leaks Real Addresses
An outside researcher's writeup on EasyOptOuts about the bug hit 278 points on Hacker News.
Why now: The writeup's 278-point run on Hacker News pushed a quiet plumbing bug into wide view.
Story
Apple's Hide My Email feature can expose the real address behind it, according to a writeup on EasyOptOuts that reached 278 points on Hacker News. The feature exists so people can sign up for accounts without handing over a real inbox. A bug that reveals the address erases that guarantee for anyone who trusted the relay to hold.
The writeup describes how the anonymized address maps back to the real one. Hide My Email is marketed as a privacy layer, so a leak here breaks its central promise, not some minor edge case.
I build products that lean on other people's infrastructure for privacy claims too. This is a reminder that those claims are only as solid as the code behind them. If an app tells users it never sees their real email, that promise runs through whatever relay sits behind it. Inherit the relay, inherit its bugs. Don't put that promise in your threat model as guaranteed.
My bet is this isn't unique to Apple. Any relay that maps an alias back to a real address for delivery has the same class of bug somewhere, found or not. The writeup only reached this many people because of its run on Hacker News. The bug itself was probably sitting there long before 278 points made it visible.
Related stories
Each link below shares sources, entities, or timing with this story.
Shared entities / Earlier coverage
"Local AI Needs to Be the Norm" and 1,159 HN Voters Agree
Both cover Apple, Hacker News; earlier Apple coverage from 2026-05-11.
Solo Dev Replaces $500/mo SaaS Stack
Both cover Builder, Hacker News; earlier Builder coverage from 2026-02-26.
Shared entity: Hacker News / Shared topic / Earlier coverage
"AI coding at home without going broke" hits #1 on Hacker News
Both cover Hacker News; overlapping topics (builder, hacker); earlier Hacker News coverage from 2026-06-15.
Shared entity: Apple / Shared topic / Earlier coverage
Google permanently removed the legacy Gemini Interactions API schema on June 8.
Both cover Apple; overlapping topics (apple, breaking); earlier Apple coverage from 2026-06-09.
Shared entity: Hacker News / Earlier coverage / Tension
Doubleword puts a date on open-weight parity: December 3, 2026
Both cover Hacker News; earlier Hacker News coverage from 2026-06-27; pushes against this story (vs).
A "replicant detector" built on Datastar, Common Lisp, and BKNR Datastore.
Both cover Hacker News; earlier Hacker News coverage from 2026-06-15; pushes against this story (but).
Shared entity: Apple / Earlier coverage / Tension
OpenHands hits 70K+ stars and an $18.8M Series A, with contributors from AMD, Apple, Google, Amazon, Netflix, and NVIDIA.
Both cover Apple; earlier Apple coverage from 2026-06-10; pushes against this story (against).
Shared entity: Builder / Earlier coverage / Tension
Enterprise platforms just split into three camps on agent access, and you have to pick a side
Both cover Builder; earlier Builder coverage from 2026-06-02; pushes against this story (versus).
Source trail
Entities
Claim evidence
- Apple's Hide My Email Leaks Real Addresses
Provenance
- Canonical issue
- 2026-07-02
- AI generated
- yes
- Story unit
- 2026-07-02-apple-s-hide-my-email-reportedly-leaks-real-addresses
- Labels
- source-backed, canonical briefing excerpt