Please do not open public issues or pull requests for security vulnerabilities.

Report vulnerabilities privately by email to security@sendtrap.dev. Include a description of the issue, a proof of concept if you have one, and the affected version(s).

You will receive an acknowledgement within 3 business days. We aim to ship a fix (or a documented mitigation) within 90 days of a confirmed report, coordinating the disclosure date with you.

Much of Sendtrap Community's surface (SMTP ingestion, MIME parsing, the inbox API, message checks) lives in the sendtrap/core package. Vulnerabilities there are tracked upstream in that repository and fixed in a new core release; Community then ships the fixed core tag as a patch release. Report to the same address either way — we will route it.

During the 0.x series, only the latest published 0.x minor receives security fixes, released as a new patch version. There is no long-term support branch before 1.0.

Security fixes ship publicly with synchronized releases of the Sendtrap distributions affected. Advisories credit reporters unless they prefer otherwise.