Hacker News Reader

Sandboxing should be handled externally by something like Flatpak

Flatpak can contain the whole app to a degree, but even if perfect that leaves all of your mail content and credentials together.