SECURITY.md still said ihasmail is under active development. It now says what maintenance mode covers: security fixes, dependency updates, Stalwart compatibility and small bug fixes.
It also names GitHub's private vulnerability reporting, which is enabled on the mirror, as a second private route, and no longer says "GitHub issue" now that issues live on Gitea.
jcoffey-dev