diff --git a/.gitignore b/.gitignore
index 0952a15..4f49310 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,6 @@
+# https://github.com/jeromecoloma/sessionx
+.sessionx.yaml
+
 .DS_Store
 .idea
 .phpunit.result.cache
@@ -11,4 +14,4 @@ phpunit.xml
 phpstan.neon
 testbench.yaml
 vendor
-!docs
\ No newline at end of file
+!docs
diff --git a/README.md b/README.md
index 5322bb2..95e2303 100644
--- a/README.md
+++ b/README.md
@@ -60,7 +60,7 @@ Optionally, you can publish the views using
 php artisan vendor:publish --tag="mails-views"
 ```
 
-Add the routes to the PanelProvider using the `routes()` method, like this:
+Add the routes to the PanelProvider using the `authenticatedRoutes()` method, like this:
 
 ```php
 use Backstage\Mails\Facades\Mails;
@@ -68,10 +68,15 @@ use Backstage\Mails\Facades\Mails;
 public function panel(Panel $panel): Panel
 {
     return $panel
-        ->routes(fn () => Mails::routes());
+        ->authenticatedRoutes(fn () => Mails::routes());
 }
 ```
 
+The preview and attachment routes also enforce panel authentication and the
+`canManageMails()` check themselves, so they remain protected if they are
+registered with `routes()`. `authenticatedRoutes()` is still the recommended
+registration method.
+
 Then add the plugin to your `PanelProvider`
 
 ```php
@@ -116,9 +121,13 @@ $panel
 
 This example demonstrates how to combine role-based and permission-based access control, providing a more robust and flexible approach to managing access to mail resources.
 
+The same `canManageMails()` check protects mail previews and attachment
+downloads. Attachments can only be downloaded through the mail record they
+belong to, and previews run in a sandboxed iframe.
+
 ### Tenant middleware and route protection
 
-If you want to protect the mail routes with your (tenant) middleware, you can do so by adding the routes to the `tenantRoutes`:
+If you want to protect the mail routes with your tenant middleware, add them to `authenticatedTenantRoutes()`:
 
 ```php
 use Backstage\Mails\MailsPlugin;
@@ -128,7 +137,7 @@ public function panel(Panel $panel): Panel
 {
     return $panel
         ->plugin(MailsPlugin::make())
-        ->tenantRoutes(fn() => Mails::routes());
+        ->authenticatedTenantRoutes(fn () => Mails::routes());
 }
 ```
 
diff --git a/resources/views/mails/preview.blade.php b/resources/views/mails/preview.blade.php
index 0f45184..b966354 100644
--- a/resources/views/mails/preview.blade.php
+++ b/resources/views/mails/preview.blade.php
@@ -1,6 +1,9 @@
 <div class="w-full h-screen">
     <iframe
-        src="{{ route('filament.' . Filament\Facades\Filament::getCurrentPanel()->getId() . '.mails.preview', ['tenant' => Filament\Facades\Filament::getTenant(), 'mail' => $mail->id]) }}"
+        srcdoc="{{ $html }}"
+        sandbox
+        referrerpolicy="no-referrer"
+        title="{{ __('Email preview') }}"
         class="w-full h-full max-w-full" style="width: 100vw; height: 100vh; border: none;">
     </iframe>
 </div>
diff --git a/src/Controllers/MailDownloadController.php b/src/Controllers/MailDownloadController.php
index 95fe4b7..c2e5e0f 100644
--- a/src/Controllers/MailDownloadController.php
+++ b/src/Controllers/MailDownloadController.php
@@ -2,24 +2,20 @@
 
 namespace Backstage\Mails\Controllers;
 
-use Backstage\Mails\Laravel\Models\MailAttachment;
+use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
 use Illuminate\Support\Facades\Config;
+use Symfony\Component\HttpFoundation\StreamedResponse;
 
 class MailDownloadController extends Controller
 {
-    public function __invoke(...$arguments)
+    public function __invoke(Request $request): StreamedResponse
     {
-        if (count($arguments) === 4) {
-            [$tenant, $mail, $attachment, $filename] = $arguments;
-        } else {
-            [$mail, $attachment, $filename] = $arguments;
-            $tenant = null;
-        }
+        $mailModel = Config::string('mails.models.mail');
 
-        $attachmentModel = Config::get('mails.models.attachment');
-        /** @var MailAttachment $attachment */
-        $attachment = $attachmentModel::find($attachment);
+        $mail = $mailModel::findOrFail($request->route('mail'));
+
+        $attachment = $mail->attachments()->findOrFail($request->route('attachment'));
 
         return $attachment->downloadFileFromStorage();
     }
diff --git a/src/Controllers/MailPreviewController.php b/src/Controllers/MailPreviewController.php
index d017789..833d1ab 100644
--- a/src/Controllers/MailPreviewController.php
+++ b/src/Controllers/MailPreviewController.php
@@ -2,17 +2,25 @@
 
 namespace Backstage\Mails\Controllers;
 
-use Backstage\Mails\Laravel\Models\Mail;
 use Illuminate\Http\Request;
 use Illuminate\Routing\Controller;
+use Illuminate\Support\Facades\Config;
+use Symfony\Component\HttpFoundation\Response;
 
 class MailPreviewController extends Controller
 {
-    public function __invoke(Request $request)
+    public function __invoke(Request $request): Response
     {
-        /** @var Mail $mail */
-        $mail = Mail::find($request->mail);
+        $mailModel = Config::string('mails.models.mail');
 
-        return response($mail->html);
+        $mail = $mailModel::findOrFail($request->route('mail'));
+
+        return response($mail->html, 200, [
+            'Content-Type' => 'text/html; charset=UTF-8',
+            'Content-Security-Policy' => "sandbox; frame-ancestors 'self'",
+            'Referrer-Policy' => 'no-referrer',
+            'X-Content-Type-Options' => 'nosniff',
+            'X-Frame-Options' => 'SAMEORIGIN',
+        ]);
     }
 }
diff --git a/src/Http/Middleware/EnsureUserCanManageMails.php b/src/Http/Middleware/EnsureUserCanManageMails.php
new file mode 100644
index 0000000..c0d3a6d
--- /dev/null
+++ b/src/Http/Middleware/EnsureUserCanManageMails.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Backstage\Mails\Http\Middleware;
+
+use Backstage\Mails\MailsPlugin;
+use Closure;
+use Filament\Facades\Filament;
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Response;
+
+class EnsureUserCanManageMails
+{
+    public function handle(Request $request, Closure $next): Response
+    {
+        $panel = Filament::getCurrentPanel();
+
+        abort_if($panel === null || ! $panel->hasPlugin('mails'), 403);
+
+        abort_unless(MailsPlugin::get()->userCanManageMails(), 403);
+
+        return $next($request);
+    }
+}
diff --git a/src/Mails.php b/src/Mails.php
index 08e8e3f..3029c19 100644
--- a/src/Mails.php
+++ b/src/Mails.php
@@ -4,13 +4,23 @@
 
 use Backstage\Mails\Controllers\MailDownloadController;
 use Backstage\Mails\Controllers\MailPreviewController;
+use Backstage\Mails\Http\Middleware\EnsureUserCanManageMails;
+use Filament\Http\Middleware\Authenticate;
 use Illuminate\Support\Facades\Route;
 
 class Mails
 {
     public static function routes(): void
     {
-        Route::get('mails/{mail}/preview', MailPreviewController::class)->name('mails.preview');
-        Route::get('mails/{mail}/attachment/{attachment}/{filename}', MailDownloadController::class)->name('mails.attachment.download');
+        Route::middleware([
+            Authenticate::class,
+            EnsureUserCanManageMails::class,
+        ])->group(function (): void {
+            Route::get('mails/{mail}/preview', MailPreviewController::class)
+                ->name('mails.preview');
+
+            Route::get('mails/{mail}/attachment/{attachment}/{filename}', MailDownloadController::class)
+                ->name('mails.attachment.download');
+        });
     }
 }
diff --git a/tests/Fixtures/TestPanelProvider.php b/tests/Fixtures/TestPanelProvider.php
index d2f2ad1..193b070 100644
--- a/tests/Fixtures/TestPanelProvider.php
+++ b/tests/Fixtures/TestPanelProvider.php
@@ -2,6 +2,7 @@
 
 namespace Backstage\Mails\Tests\Fixtures;
 
+use Backstage\Mails\Mails;
 use Backstage\Mails\MailsPlugin;
 use Filament\Panel;
 use Filament\PanelProvider;
@@ -14,7 +15,10 @@ public function panel(Panel $panel): Panel
             ->default()
             ->id('admin')
             ->path('admin')
+            ->login()
+            ->authGuard('web')
             ->topNavigation()
+            ->routes(fn () => Mails::routes())
             ->plugin(MailsPlugin::make());
     }
 }
diff --git a/tests/Fixtures/User.php b/tests/Fixtures/User.php
new file mode 100644
index 0000000..178e563
--- /dev/null
+++ b/tests/Fixtures/User.php
@@ -0,0 +1,23 @@
+<?php
+
+namespace Backstage\Mails\Tests\Fixtures;
+
+use Filament\Models\Contracts\FilamentUser;
+use Filament\Panel;
+use Illuminate\Foundation\Auth\User as Authenticatable;
+
+class User extends Authenticatable implements FilamentUser
+{
+    protected $table = 'users';
+
+    protected $fillable = [
+        'name',
+        'email',
+        'password',
+    ];
+
+    public function canAccessPanel(Panel $panel): bool
+    {
+        return true;
+    }
+}
diff --git a/tests/MailRouteSecurityTest.php b/tests/MailRouteSecurityTest.php
new file mode 100644
index 0000000..60f6c50
--- /dev/null
+++ b/tests/MailRouteSecurityTest.php
@@ -0,0 +1,169 @@
+<?php
+
+use Backstage\Mails\Laravel\Models\Mail;
+use Backstage\Mails\Laravel\Models\MailAttachment;
+use Backstage\Mails\MailsPlugin;
+use Backstage\Mails\Tests\Fixtures\User;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
+
+function mailUser(): User
+{
+    return User::create([
+        'name' => 'Test User',
+        'email' => 'test@example.com',
+        'password' => Hash::make('password'),
+    ]);
+}
+
+function attachmentFor(Mail $mail, string $filename = 'invoice.pdf', string $contents = 'CONFIDENTIAL'): MailAttachment
+{
+    $attachment = $mail->attachments()->create([
+        'uuid' => (string) Str::uuid(),
+        'disk' => 'local',
+        'filename' => $filename,
+        'mime' => 'application/pdf',
+        'inline' => false,
+        'size' => strlen($contents),
+    ]);
+
+    Storage::disk('local')->put($attachment->storagePath, $contents);
+
+    return $attachment;
+}
+
+function previewUrl(Mail $mail): string
+{
+    return route('filament.admin.mails.preview', ['mail' => $mail->getKey()]);
+}
+
+function downloadUrl(Mail $mail, MailAttachment $attachment): string
+{
+    return route('filament.admin.mails.attachment.download', [
+        'mail' => $mail->getKey(),
+        'attachment' => $attachment->getKey(),
+        'filename' => $attachment->filename,
+    ]);
+}
+
+it('redirects a guest away from the mail preview', function () {
+    $mail = Mail::factory()->create(['html' => '<p>secret</p>']);
+
+    $this->get(previewUrl($mail))
+        ->assertRedirect(route('filament.admin.auth.login'));
+});
+
+it('forbids an authenticated user without mail permissions', function () {
+    $mail = Mail::factory()->create(['html' => '<p>secret</p>']);
+
+    MailsPlugin::get()->canManageMails(false);
+
+    $this->actingAs(mailUser())
+        ->get(previewUrl($mail))
+        ->assertForbidden();
+});
+
+it('allows a permitted user to preview a mail with hardening headers', function () {
+    $mail = Mail::factory()->create(['html' => '<p>secret</p>']);
+
+    MailsPlugin::get()->canManageMails(true);
+
+    $this->actingAs(mailUser())
+        ->get(previewUrl($mail))
+        ->assertSuccessful()
+        ->assertSee('secret')
+        ->assertHeader('Content-Type', 'text/html; charset=UTF-8')
+        ->assertHeader('Content-Security-Policy', "sandbox; frame-ancestors 'self'")
+        ->assertHeader('Referrer-Policy', 'no-referrer')
+        ->assertHeader('X-Content-Type-Options', 'nosniff')
+        ->assertHeader('X-Frame-Options', 'SAMEORIGIN');
+});
+
+it('returns not found for an unknown mail preview', function () {
+    MailsPlugin::get()->canManageMails(true);
+
+    $url = route('filament.admin.mails.preview', ['mail' => 99999]);
+
+    $this->actingAs(mailUser())->get($url)->assertNotFound();
+});
+
+it('redirects a guest away from an attachment download', function () {
+    Storage::fake('local');
+
+    $mail = Mail::factory()->create();
+    $attachment = attachmentFor($mail);
+
+    $this->get(downloadUrl($mail, $attachment))
+        ->assertRedirect(route('filament.admin.auth.login'));
+});
+
+it('forbids an authenticated user without mail permissions from downloading an attachment', function () {
+    Storage::fake('local');
+
+    $mail = Mail::factory()->create();
+    $attachment = attachmentFor($mail);
+
+    MailsPlugin::get()->canManageMails(false);
+
+    $this->actingAs(mailUser())
+        ->get(downloadUrl($mail, $attachment))
+        ->assertForbidden();
+});
+
+it('does not serve an attachment belonging to a different mail', function () {
+    Storage::fake('local');
+
+    $mail = Mail::factory()->create();
+    $otherMail = Mail::factory()->create();
+    $attachmentOfOtherMail = attachmentFor($otherMail, 'secret.pdf');
+
+    MailsPlugin::get()->canManageMails(true);
+
+    $this->actingAs(mailUser())
+        ->get(downloadUrl($mail, $attachmentOfOtherMail))
+        ->assertNotFound();
+});
+
+it('serves an attachment that belongs to the mail', function () {
+    Storage::fake('local');
+
+    $mail = Mail::factory()->create();
+    $attachment = attachmentFor($mail, 'invoice.pdf', 'INVOICE BODY');
+
+    MailsPlugin::get()->canManageMails(true);
+
+    $response = $this->actingAs(mailUser())
+        ->get(downloadUrl($mail, $attachment))
+        ->assertSuccessful();
+
+    expect($response->streamedContent())->toBe('INVOICE BODY');
+});
+
+it('returns not found for an unknown attachment', function () {
+    Storage::fake('local');
+
+    $mail = Mail::factory()->create();
+
+    MailsPlugin::get()->canManageMails(true);
+
+    $url = route('filament.admin.mails.attachment.download', [
+        'mail' => $mail->getKey(),
+        'attachment' => 99999,
+        'filename' => 'missing.pdf',
+    ]);
+
+    $this->actingAs(mailUser())->get($url)->assertNotFound();
+});
+
+it('renders stored html in a sandboxed inline preview', function () {
+    $html = '<script>window.parent.document.body.remove()</script><p>Preview</p>';
+
+    $preview = view('mails::mails.preview', ['html' => $html])->render();
+
+    expect($preview)
+        ->toContain('srcdoc="&lt;script&gt;')
+        ->toContain('sandbox')
+        ->toContain('referrerpolicy="no-referrer"')
+        ->not->toContain('src="');
+});
diff --git a/tests/TestCase.php b/tests/TestCase.php
index 5f7b71b..65f290c 100644
--- a/tests/TestCase.php
+++ b/tests/TestCase.php
@@ -2,8 +2,10 @@
 
 namespace Backstage\Mails\Tests;
 
+use Backstage\Mails\Laravel\MailsServiceProvider as LaravelMailsServiceProvider;
 use Backstage\Mails\MailsServiceProvider;
 use Backstage\Mails\Tests\Fixtures\TestPanelProvider;
+use Backstage\Mails\Tests\Fixtures\User;
 use BladeUI\Heroicons\BladeHeroiconsServiceProvider;
 use BladeUI\Icons\BladeIconsServiceProvider;
 use Filament\Actions\ActionsServiceProvider;
@@ -15,6 +17,9 @@
 use Filament\Tables\TablesServiceProvider;
 use Filament\Widgets\WidgetsServiceProvider;
 use Illuminate\Database\Eloquent\Factories\Factory;
+use Illuminate\Database\Schema\Blueprint;
+use Illuminate\Support\Facades\File;
+use Illuminate\Support\Facades\Schema;
 use Livewire\LivewireServiceProvider;
 use Orchestra\Testbench\TestCase as Orchestra;
 use RyanChandler\BladeCaptureDirective\BladeCaptureDirectiveServiceProvider;
@@ -45,6 +50,7 @@ protected function getPackageProviders($app)
             SupportServiceProvider::class,
             TablesServiceProvider::class,
             WidgetsServiceProvider::class,
+            LaravelMailsServiceProvider::class,
             MailsServiceProvider::class,
             TestPanelProvider::class,
         ];
@@ -53,5 +59,24 @@ protected function getPackageProviders($app)
     public function getEnvironmentSetUp($app)
     {
         config()->set('database.default', 'testing');
+        config()->set('auth.providers.users.model', User::class);
+    }
+
+    protected function defineDatabaseMigrations(): void
+    {
+        Schema::create('users', function (Blueprint $table): void {
+            $table->id();
+            $table->string('name');
+            $table->string('email')->unique();
+            $table->string('password');
+            $table->rememberToken();
+            $table->timestamps();
+        });
+
+        $directory = __DIR__ . '/../vendor/backstage/laravel-mails/database/migrations';
+
+        foreach (File::files($directory) as $file) {
+            (include $file->getPathname())->up();
+        }
     }
 }