Report vulnerabilities privately through GitHub Security Advisories. If Report a vulnerability is unavailable, open an issue requesting a private contact without disclosing the vulnerability. Include the affected version, reproduction steps using synthetic data, and potential impact in your private report. Never publish real email, Recovery Keys, tokens, or credentials.

• The relay processes SMTP email in transit and does not persist an inbox. Its logs name an IP address only when a protection rule refuses or limits it, and its metrics are totals without addresses or identities. TLS and a pinned Noise session protect the relay-to-client protocol, including through a TLS-terminating proxy. Obtain the relay's public transport key through an independent trusted channel. SMTP senders, forwarding providers, and the relay can still read email; this is not sender-to-recipient encryption.
• SQLCipher encrypts the local inbox, WAL, and exported snapshots with a key derived from the Recovery Identity. Anyone with the Identity file or Recovery Key and the database can decrypt it. Runtime memory, earlier plaintext copies, exported EML, and attachments are outside this protection. On Linux and macOS, an Identity file readable by other users is refused until its permissions are fixed.
• Database import validates integrity before replacing data. It requires the matching Recovery Key, an offline destination, and explicit --replace to overwrite an existing inbox. Identity replacement is refused while an inbox exists.
• Local MCP uses HTTP and requires the local API bearer token by default, even on loopback; the stdio bridge reads the token from the profile. Setting mcp_auth = false lets any local process use the inbox through MCP. Host and Origin checks restrict browser access. Enable --https when needed. The HTTP API is disabled by default and always requires the bearer token; Web has a separate optional password. LAN mode requires HTTPS and MCP authentication. Keep the service on loopback or a trusted private LAN.
• The browser app stores its Recovery Key in the browser's IndexedDB next to the messages, addresses and custom domain it encrypts with a key derived from it: like the CLI's Identity file beside its database, this protects copies of the records, not access to the browser profile. Pages are generated by the app's Service Worker with the Web page's Content Security Policy, and email HTML stays in a sandboxed frame. Anyone who can change the files served from the app's origin can read the inbox, so it must be served only from a trusted host with HTTPS. The relay accepts browser connections only from origins listed in AHRARA_WEB_ORIGINS.
• The install.sh and install.ps1 installers check each binary's size and SHA-256 against the release manifest. ahrara update and the agent plugin also verify its Ed25519 signature and only move to newer versions. The Go SDK downloads its native library from the GitHub Release and loads it only if it matches the SHA-256 pinned in the module version, which the Go checksum database records.
• MCP saves attachments only into the attachments directory next to the profile database, never overwriting existing files.
• Email is untrusted input, including when passed to an AI agent. Bidi overrides and isolates are removed from the From, To, Cc and Subject shown, so they cannot reorder them.

See the user guide for configuration and backups.