25 lines
1.0 KiB
Markdown
25 lines
1.0 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
| Version | Supported |
|
|
| ------- | ------------------ |
|
|
| latest | :white_check_mark: |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability, please report it by opening a GitHub issue with the `security` label. Do NOT open a public issue for security flaws that could expose user data.
|
|
|
|
We will acknowledge your report within 48 hours and work on a fix.
|
|
|
|
## Security Considerations for Users
|
|
|
|
⚠️ **This tool handles OAuth tokens and email passwords. Please follow these security best practices:**
|
|
|
|
1. **Never commit `.env` files** — they contain passwords and token paths
|
|
2. **Protect the `tokens/` directory** — OAuth tokens grant access to your email
|
|
3. **Use file permissions**: `chmod 600 tokens/*.token`
|
|
4. **Never share log files** — they may contain email content snippets
|
|
5. **Rotate tokens** by deleting the token file and reauthorizing periodically
|
|
6. **Use a dedicated Azure App** — don't reuse OAuth credentials from other apps
|