Skip to content
NewA free test that shows whether your emails will reach the inbox.

Last updated

Report a security vulnerability

If you find a weakness in Sukhovei Mail, we want to hear about it first. This page says how to tell us, what is covered, and how we will treat you.

Contents (5)

How to report

Email security@mailbay.dev. Say what you found, the steps to reproduce it, and what an attacker could do with it. Screenshots, requests and responses help. Please do not post the details publicly until we have fixed it or agreed a date with you. If you want to encrypt the report, ask for a key in a first message that has no details.

In scope

  • mailbay.dev and its subdomains that we run: the website, the dashboard, the REST API (/v1) and the MCP server.
  • Our mail servers for receiving, SMTP submission and IMAP.
  • Anything that lets one workspace read, change or detect another's data, bypasses a permission, an API key scope or a rate limit, or exposes a secret.

Out of scope

  • Denial of service, load testing, and spam or social engineering of anyone, including us.
  • Findings that need a rooted device or a compromised mailbox, and missing best practice headers with no impact.
  • Third party services we use. Report those to the provider: Amazon SES, Vercel, OVHcloud.
  • Reports from automated scanners with no demonstrated impact.

Rules for research

  • Use your own workspace and test accounts. Do not access, change or delete anyone else's data.
  • Stop as soon as you have proof. Do not keep or share data you reach by accident, and tell us what you saw.
  • Do not use a finding to disrupt the service or to pivot into other systems.

What we promise

  • We acknowledge your report within 3 business days and tell you what we plan to do.
  • If you follow these rules, we will not take legal action against you or ask a service provider to block you for good faith research.
  • We keep you informed until it is fixed, and credit you publicly if you want, once it is.
  • We do not run a paid bounty. We are one person and cannot offer rewards, only thanks and credit.

See also Security. A machine readable version of this policy is at /.well-known/security.txt.