Initial commit: Multi-account IMAP sync with OAuth2 support

2026-08-10 05:54:52 +08:00
commit 482298371e
13 changed files with 1436 additions and 0 deletions
@@ -0,0 +1,24 @@
+# Security Policy
+
+## Supported Versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| latest  | :white_check_mark: |
+
+## Reporting a Vulnerability
+
+If you discover a security vulnerability, please report it by opening a GitHub issue with the `security` label. Do NOT open a public issue for security flaws that could expose user data.
+
+We will acknowledge your report within 48 hours and work on a fix.
+
+## Security Considerations for Users
+
+⚠️ **This tool handles OAuth tokens and email passwords. Please follow these security best practices:**
+
+1. **Never commit `.env` files** — they contain passwords and token paths
+2. **Protect the `tokens/` directory** — OAuth tokens grant access to your email
+3. **Use file permissions**: `chmod 600 tokens/*.token`
+4. **Never share log files** — they may contain email content snippets
+5. **Rotate tokens** by deleting the token file and reauthorizing periodically
+6. **Use a dedicated Azure App** — don't reuse OAuth credentials from other apps