RayMail is pre-1.x in practice; security fixes land on main. Please run the
latest commit before reporting.
Do not open a public issue for a security problem.
Use GitHub's private reporting instead: go to the repository's Security tab and choose Report a vulnerability. That opens a private advisory only the maintainers can see.
Please include:
- what the issue is and which component it affects
- steps to reproduce, or a proof of concept
- what an attacker gains
You can expect an acknowledgement within a few days.
RayMail runs a mail server, so the interesting boundaries are:
| Area | What matters |
|---|---|
| Tracking tokens | Open and click tokens are HMAC-signed. Forging one, or repointing the click redirector, is a vulnerability. |
| Session cookies | Credentials are AES-256-GCM sealed in an httpOnly cookie. Recovering a credential from a cookie is a vulnerability. |
| Message reader | Mail renders in a sandboxed iframe with no allow-scripts. Script execution or same-origin access is a vulnerability. |
| Attachments | Only an allowlist of types is served inline, under a sandbox CSP. Getting arbitrary content to render inline is a vulnerability. |
| Admin API | Authorisation is delegated to Stalwart. A normal mailbox reaching a management method is a vulnerability. |
| Mail relay | Anything that lets an unauthenticated party send mail through the server is a vulnerability. |
- Missing hardening on a deployment you configured yourself (no TLS, open ports, weak passwords)
- Deliverability and spam-folder placement
- Findings from automated scanners without a working proof of concept