We ditched Gmail OAuth because we couldn't afford the security audit
feedimmo aggregates property alerts from portals like SeLoger, Idealista, and PAP into a single scored feed. Built for people searching for property across borders, where you're typically signed up to three or four portals and drowning in alerts.
To make it work, we need to read the alert emails the portals send you. We built Gmail OAuth first. Then we hit Google's CASA Tier 2 security assessment, which is required for any app that accesses Gmail data. Not a technical problem, a budget one. The audit costs thousands, we're pre-revenue, so we cut it.
What we ship instead: each user gets a unique forwarding address. You set up a Gmail filter (we generate the XML, one import and it's done) and portal alerts get forwarded automatically. Or manual forward one at a time if you don't want to touch filters.
It works, but I'm never sure whether "import this XML file" is fine for a normal person or a silent drop-off point.
Curious if anyone else has hit the CASA wall and how you handled it. And if the forwarding flow sounds like something you'd actually set up, or whether you'd close the tab.
