Please report vulnerabilities privately through GitHub: Report a vulnerability. If you can't use GitHub, email [email protected]. Please don't open a public issue.

Include the MailFlow version, how you install it (Docker, native, desktop or Android app), and steps to reproduce. MailFlow is maintained by one person, so a first reply can take a few days.

Security fixes go into the latest release. Update to the newest version to receive them.

Fixes are released publicly to everyone at the same time, with the issue described in the release notes. Hosting and MSP partners get an email before a security release with its date and severity, not the fix itself.