Prevent sensitive email data from leaking through logs and caches

[jzhao234]

Problem

Explorer handles sensitive client email data in URL query parameters, including sender/recipient filters, subject and body-search terms, S3 keys, and attachment filenames. Caddy access logging is enabled, and authenticated responses do not currently set a restrictive cache policy.

This can copy client information into access logs, browser history, reverse-proxy/monitoring systems, support bundles, and browser or intermediary caches.

Desired behavior

Prevent sensitive Explorer data from being retained outside the archive and explicitly approved audit records.

Required controls:

• Redact or omit query strings from reverse-proxy and application access logs.
• Do not log passwords, raw session cookies, CSRF tokens, complete email bodies, attachment content, or AWS credentials.
• Return Cache-Control: no-store on authenticated HTML, email detail, search results, login responses containing cookies, and attachment responses. Add compatible legacy cache headers where appropriate.
• Ensure errors shown to users do not expose S3 SDK details, filesystem paths, bucket configuration, or other internal data.
• Decide whether sensitive search criteria and S3 keys may remain in browser-visible URLs. If not, move them into POST/server-side state and use opaque identifiers for navigation.
• Keep security/audit events structured and separate from general access logs; audit records should identify the acting user and stable message/object identifier without recording message bodies or credentials.

Acceptance criteria

• Caddy and application access logs do not contain request query strings for search, /email, or /attachment requests.
• Authenticated responses and downloads include Cache-Control: no-store.
• Login responses that set or clear session cookies are not cacheable.
• Browser-facing 4xx/5xx responses contain generic messages and do not expose raw AWS/filesystem exceptions.
• Authentication and authorization failures never log passwords or raw tokens.
• Any retained audit record format is documented, including fields, retention, and redaction rules.
• Tests assert cache headers and sanitized error responses on inbox, email-detail, attachment, login, and logout paths.
• A deployment-level test or documented verification confirms the rendered Caddy configuration redacts query strings.

Security/privacy impact

Email metadata and search terms can be client-confidential even when the underlying message body is never logged. This issue reduces inadvertent secondary copies and makes retention behavior explicit.