If you discover a security vulnerability in DRIT.Mail, please report it responsibly:
- Do not open a public GitHub issue.
- Email security@dritsoftware.com with a description of the vulnerability and, if possible, a proof of concept.
- You will receive an acknowledgment within 48 hours.
We ask that you give us a reasonable window to investigate and publish a fix before disclosing the issue publicly.
The following are in scope:
- Buffer overflows, deserialization flaws, or other memory-safety issues in the file-format parsers (MSG, PST, MIME, iCalendar, vCard, MBOX, TNEF).
- Cryptographic flaws in the S/MIME, DKIM, CMS, or X.509 implementations.
- TLS or authentication weaknesses in the SMTP, POP3, or IMAP clients.
- Path traversal or arbitrary file write via any API.
The following are out of scope:
- Vulnerabilities in dependencies (DRIT.Mail has none).
- Issues requiring a malicious mail server under the attacker's control (the protocol clients trust the server's responses within RFC bounds).
Only the latest release on the main branch receives security fixes.