People trust MailCraft with years of correspondence and with the sign-ins to their mail, so a security problem is treated before feature work.

Please don't open a public issue. Report it privately through GitHub: Report a vulnerability (the repository's Security tab, "Report a vulnerability").

Say what you found, the version (File › About, or Copy Diagnostics), the platform, and how to reproduce it. Use synthetic mail and example.org addresses; never send us real mail, passwords or tokens.

We aim to acknowledge a report within 3 working days, to agree a fix and a date for disclosure with you, and to credit you in the advisory unless you'd rather not be named.

Fixes go into the latest release only. Please check that a problem still happens there.

Anything that breaks what MailCraft promises (see PRIVACY.md and the rules in AGENTS.md), for example:

• something in a message that runs, fetches from the network by itself, or reaches outside its display (HTML, CSS, a link, a picture, an attachment, a header);
• a crash, hang or runaway memory use caused by a message, a server's answer or a mailbox file;
• a password, refresh token or access token written to a file, a log or an error, or sent anywhere but the provider it belongs to;
• a connection that carries mail or a sign-in without TLS, or a certificate that isn't checked;
• header injection in mail that MailCraft writes;
• a picture download that reaches a private, loopback or link-local address, or sends cookies, a referrer or credentials;
• the control port or the MCP server accepting a command without its key.

• There is no S/MIME or OpenPGP yet: signed and encrypted parts are shown as attachments.
• The mailbox file on disk isn't encrypted by MailCraft; it relies on the operating system's disk encryption (BitLocker, FileVault, LUKS).
• Anyone who can run programs as you on your computer can read your mailbox; MailCraft doesn't protect against that.