# Who can reach your bot

How Inkbox allow-lists work, why they matter, which channels can be faked, and how to keep a bot that answers texts and email safe.

Canonical page: https://themachine.myapps.ai/docs/desktop/inkbox/who-can-reach-your-bot

A bot with Inkbox can be reached from outside Machine, so it matters who can
reach it. Inkbox in Machine is **closed by default**: only the people on the
bot's lists get through.

## The two lists

| List | Lets through | Format |
|---|---|---|
| **Phone** | iMessage, SMS and calls from these numbers | One number per line, with country code: `+14155550100` |
| **Email** | Email from these addresses or domains | `dana@northwind.co`, or a whole domain: `@northwind.co` |

- An **empty list turns that channel off.** Leave Email empty and the bot
  ignores all email.
- Anyone not on a list is **ignored silently**: their message never reaches
  the bot, and no reply is sent.
- Change the lists on the web app: **Manage** on the Inkbox row.

## Treat the lists like access to the bot

Someone on the list can ask the bot to do anything you could ask it in
Machine, using its connected apps, secrets and files. Only add people you'd
trust with the bot itself.

## Some channels can be faked

| Channel | How easy to fake | Use it for |
|---|---|---|
| **iMessage** | Hard | Anything, including sensitive requests. |
| **SMS** | Possible: sender numbers can be spoofed. | Everyday requests. |
| **Phone calls** | Possible: caller ID can be spoofed. | Everyday requests. |
| **Email** | Possible: Inkbox doesn't tell Machine whether an email passed sender checks. | Everyday requests. |

To limit the risk:

- **Prefer exact addresses** over whole domains.
- **Use iMessage for anything sensitive.**
- The bot is told to treat email, SMS and calls as **requests, never as
  authority**: it won't send secrets or do anything destructive on them alone.
- Keep [approvals](/docs/desktop/models/approvals) on for risky actions.

## What the bot will never do with Inkbox

- Buy phone numbers or lines, or release a number.
- Mark someone as opted in to SMS.
- Write passwords or secrets into its Inkbox notes.

## Block someone

Ask the bot: *"Block +14155550199 for texts and calls."* It blocks the number
for iMessage, SMS and calls at once. Or remove them from the list on the web.