# Security policy

OpenMail runs a parser on port 25, exposed to the open internet, with its
source published. That is the same position Postfix and Mox are in, and it is
safe only with a real disclosure process. This is ours.

## Reporting

**Do not open a public issue for a security bug.**

Use GitHub's [private vulnerability reporting](https://github.com/karti-ai/openmail/security/advisories/new),
or email the maintainer. We will acknowledge within 72 hours.

## Scope — what we consider a vulnerability

- Anything reachable pre-authentication on the SMTP listener.
- MIME parsing that panics, hangs, or allocates unboundedly on crafted input.
- **A silent downgrade of a security property**: DANE or MTA-STS reporting
  success where the policy was not actually satisfied, or a policy that should
  have been enforced being skipped. These are the highest-severity class in
  this codebase precisely because they do not look like failures.
- Cross-tenant (`pod`) data access.
- Authentication or scope bypass in the REST or MCP surfaces — especially an
  MCP tool reaching a credential route (see `openmail_mcp::Exposure`).

## Not in scope

- Deliverability problems (mail landing in spam).
- Missing rate limits on an endpoint behind authentication, unless it is
  amplification.
- Reports from automated scanners with no demonstrated impact.