Security policy

Do not report security issues in public issues, pull requests or discussions. Report them privately, so the issue can be fixed before it is disclosed.

Supported versions

Security fixes go into the latest release of the current stable line (2.4.x). Upgrade to it before reporting.

Reporting a vulnerability

Use one of these channels:

• the Report a vulnerability button on the repository's Security tab (preferred)
• email to [email protected]

Include the affected version, the relevant part of the configuration, steps to reproduce, and the impact you observed.

We acknowledge a report within 7 days.

Bounties

There is no bounty program.

Advisories

Published advisories and the full policy are at yarilomail.org/security.

Fixes with no advisory of their own are listed under Security in the release notes. In 2.4.4 that is #2297: require "ihave" bypassed the sieve_extensions whitelist, but only on installations that had added ihave to sieve_extensions; the default list does not include it.