Security fixes are provided for the latest release and the default branch. Older releases are not supported. Upgrade before reporting an issue that may already be fixed.

Do not open a public issue, pull request, or discussion for a suspected vulnerability.

Use either private channel:

• GitHub Security Advisories. Open a private report from this repository's Security tab, Report a vulnerability. This is the preferred channel.
• Email. jechenmailman@gmail.com, with a subject line that begins with [SECURITY].

Include the affected version, platform, impact, and steps to reproduce. Do not attach credentials, tokens, or unredacted logs.

The maintainers aim to acknowledge a report within 5 business days, and to coordinate a fix and disclosure within 90 days. There is no bug-bounty promise.

Mailbox credentials come from the action or the environment, not from this repository. Leave TLS verification enabled.

Some older SMTP and IMAP wrappers log a failure and return no value. A missing return does not prove that a message was sent. Newer providers raise MailThunderException on failure.