posta hosts other people's email, so we take reports seriously.

Report a vulnerability privately: use GitHub's "Report a vulnerability" button (Security tab), or write to security@preved.co. Please do not open a public issue.

Include what you found, how to reproduce it, and what an attacker could do. We confirm receipt within 3 business days and tell you what we decide. Please give us a reasonable time to fix before you publish.

In scope: this repository and the hosted service at posta.preved.co. Out of scope: denial of service, spam tests against other people's mailboxes, social engineering.

Never put real credentials, API keys or customer data in issues or pull requests.