Security

Do not open a public issue with a vulnerability, credential, private email, screenshot, or raw .eml file.

Follow the private reporting instructions in the repository's SECURITY.md. If private GitHub reporting is unavailable, email the Maillume security contact. security@maillume.io.

• Provider and Supabase secret keys are server-only and must never use a NEXT_PUBLIC_ prefix.
• Uploaded screenshot and .eml files are parsed in the browser rather than uploaded as source files.
• Analysis inputs are size-limited and validated before processing.
• Public traffic reaches the production container through a protected Cloudflare Tunnel rather than an exposed web port.
• Application and edge rate limits reject abusive analysis traffic before provider invocation.
• Analysis and feedback responses use no-store caching behavior.
• Optional feedback uses an allowlist that rejects email-content fields.
• Integration API keys are shown once and stored only as SHA-256 hashes with revocable, atomic quotas.
• The browser extension uses temporary activeTab access after an explicit user action.
• Public hosted analysis remains heuristic-only until explicit AI privacy and cost gates pass.

Use invented identities, reserved domains such as .example or .test, and non-functional links. Do not test with a third party's inbox, account, or infrastructure without authorization.

Security fixes target the latest version on the main branch and the current public-beta release. Self-hosted operators are responsible for applying updates to their deployments.