Incoming email is a feature that accepts mail and turns it into project data, such as creating a new issue, updating an existing ticket, or adding a comment. In collaboration platforms, it is used to reduce friction so users can work from their mail client instead of opening the web interface.
From a security perspective, incoming email is a trust boundary. The system must decide which messages are valid, which project they belong to, and what action they are allowed to trigger. If the receiving address is private or user-specific, possession of that address can function like a secret. Attackers may abuse a leaked address to create unauthorized objects, flood a project with noise, or chain the action into broader workflow abuse. Defenses include treating the address as sensitive, rotating it when exposed, validating sender and message content, limiting what email can modify, and monitoring for unusual submissions.