jcoffey-dev
3fd909cba3
GitHub took the organization's repos and GHCR offline on 2026-09-20. Repo, release, raw-file and clone links now go to Gitea at git.coffeylabs.org, container images to registry.coffeylabs.org, and GitLab-style /-/blob paths to Gitea's /src/branch form. Go module paths are identifiers and stay as they are; links to GitHub issues and pull requests are left as history.
1.3 KiB
1.3 KiB
Security Policy
Supported Versions
Security fixes go into the latest release. Older releases do not receive backported fixes; a fixed release is a download away, and the tool keeps no state of its own between runs.
| Version | Supported |
|---|---|
| Latest release | ✅ |
| Older releases | ❌ |
Reporting a Vulnerability
Please do not open a public GitHub issue for security vulnerabilities.
Report them privately by emailing johnellisATlinuxDOTcom, with:
- A description of the issue and its impact
- Steps to reproduce
- The ihasmail-oneshot version (
ihasmail-oneshot version) - Whether it is in the tool itself or in the deployment it writes
You should hear back within a few days. Once a fix is released, disclosure timing and credit are coordinated with you.
Scope
In scope:
- Secrets the tool generates or writes: file modes, where they end up, what outlives the setup
- The deployment it writes: what it publishes, and what it tells Stalwart to trust (forwarded client addresses, addresses exempt from bans)
- The Caddyfile and compose.yaml it renders
Out of scope, and best reported upstream:
- Vulnerabilities in Stalwart itself
- Vulnerabilities in ihasmail itself — see its security policy
- Vulnerabilities in Caddy or Docker