Reporting a vulnerability

Report it privately on GitHub, in the repository it affects: open its Security tab and choose Report a vulnerability. Only the maintainers see it. For the mail server, that is rest-mail-server's private report form.

Or email hello@rest-mail.com, with "Security" in the subject. Either way, please don't open a public GitHub issue for it.

Tell us:

• what is affected: the server, the app or this website, and which version;
• how to make it happen, step by step;
• what someone could do with it.

We confirm that we have your report, work on a fix, and tell you when it is out. We would like to thank you by name in the release notes; say if you would rather not be named.

• The mail server and its gateways: rest-mail/rest-mail-server.
• The app for iPhone and Android: rest-mail/rest-mail-mobile.
• The project's Go libraries, at github.com/rest-mail.
• This website: rest-mail/website.

A REST Mail server someone else runs is theirs. A problem with how it is set up goes to its operator; a bug in REST Mail itself comes to us.

• read other people's mail, or get into their accounts;
• disrupt servers that aren't yours;
• trick people into helping you.

Test against a server you installed yourself.

The same, in the standard form (RFC 9116), is at /.well-known/security.txt.