Karti TripathiandClaude Opus 5
36b15ddcaf
Supersedes the Go + embed-Mox design. The Go tree is removed; its
architecture doc is preserved at docs/archive/ARCHITECTURE-go-embed-mox.md
because its competitive analysis and data model still hold.
Five decisions recorded as ADRs:
0001 Rust, not Go — accepting ~5,500 lines of protocol code that Mox
would have given us free, to get the first permissively licensed
Rust mail server. Costs stated plainly.
0002 Apache-2.0, not MIT or AGPL — patent grant, trademark, CLA-free
contribution. Public on GitHub; Gitea stays as the private fallback.
0003 Stalwart's primitive crates (Apache-2.0/MIT) yes; its AGPL server
crates never. DANE and MTA-STS sit on the AGPL side of that line,
which is why we write our own.
0004 Milestones, reordered: embedded inbound is required at launch.
0005 Oracle Cloud blocks outbound :25, so direct-to-MX is impossible on
the launch host. Split delivery is mandatory, not an on-ramp.
Twelve crates in three tiers. Tier 1 (mail-dane, mail-mta-sts, mail-dsn)
is standalone and publishable — no `dane` or `mta-sts` crate exists on
crates.io at all today.
openmail-relay ships the provider table as data, with SES and Oracle from
the start. Oracle's and Resend's SPF includes are deliberately None: a
guessed include turns the DNS check green against a mechanism the provider
does not honour, and mail still fails SPF silently.
cargo check/test/clippy/fmt all green; unsafe_code is forbidden workspace
wide; cargo-deny enforces the licence policy in CI.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JkyvfNJGTshJNE9FtwPLk7
32 lines
1.3 KiB
Markdown
32 lines
1.3 KiB
Markdown
# Security policy
|
|
|
|
OpenMail runs a parser on port 25, exposed to the open internet, with its
|
|
source published. That is the same position Postfix and Mox are in, and it is
|
|
safe only with a real disclosure process. This is ours.
|
|
|
|
## Reporting
|
|
|
|
**Do not open a public issue for a security bug.**
|
|
|
|
Use GitHub's [private vulnerability reporting](https://github.com/karti-ai/openmail/security/advisories/new),
|
|
or email the maintainer. We will acknowledge within 72 hours.
|
|
|
|
## Scope — what we consider a vulnerability
|
|
|
|
- Anything reachable pre-authentication on the SMTP listener.
|
|
- MIME parsing that panics, hangs, or allocates unboundedly on crafted input.
|
|
- **A silent downgrade of a security property**: DANE or MTA-STS reporting
|
|
success where the policy was not actually satisfied, or a policy that should
|
|
have been enforced being skipped. These are the highest-severity class in
|
|
this codebase precisely because they do not look like failures.
|
|
- Cross-tenant (`pod`) data access.
|
|
- Authentication or scope bypass in the REST or MCP surfaces — especially an
|
|
MCP tool reaching a credential route (see `openmail_mcp::Exposure`).
|
|
|
|
## Not in scope
|
|
|
|
- Deliverability problems (mail landing in spam).
|
|
- Missing rate limits on an endpoint behind authentication, unless it is
|
|
amplification.
|
|
- Reports from automated scanners with no demonstrated impact.
|