chmod a+r the exported parts so they can be served

create temp files in /tmp and don't allow writes to "." there's little point to use pledge/unveil and then allow the program to modify itself...

use file -b instead of regex on the output

exports (some) parts of the email