Security and vulnerability disclosure

AnyMail hosts other people's email, so we take reports about its security seriously and are grateful to anyone who takes the time to send one. This page explains how to report a vulnerability, what we consider in scope, and what you can expect from us in return. It is also the policy our security.txt file points to.

1. How to report a vulnerability

Email security@anymail.tech. Please include:

• what the problem is and which part of AnyMail it affects (a URL, an API endpoint, an SMTP port);
• the steps needed to reproduce it, and a proof of concept if you have one;
• what an attacker could achieve with it, as you understand it;
• how you would like to be credited, or that you would rather not be.

Write in English or Polish. Please don't report vulnerabilities through the in-app feedback form or a public issue tracker - neither is private.

2. What is in scope

• the AnyMail web application and its API at anymail.tech, including the Developer API under /api/v1;
• AnyMail's own mail servers: inbound SMTP, authenticated SMTP submission and outbound delivery;
• the official client SDKs for TypeScript, Python and Go;
• anything that lets one AnyMail customer read, change or send as another customer's mail server, inbox or messages - this is the class of issue we most want to hear about.

3. What is out of scope

• denial-of-service, load or volumetric testing, and anything that degrades the service for other customers;
• social engineering, phishing or physical attacks against AnyMail staff, customers or premises;
• sending spam, or mail to addresses that did not agree to receive it, to test filtering or delivery;
• domains, mail servers and content owned by our customers - report those to the customer, not to us, unless the problem is in AnyMail itself;
• third-party services we use (for example our payment provider) - report those to their own programmes;
• findings without a demonstrated security impact, such as missing headers on pages with no sensitive content, version banners, or automated scanner output that hasn't been verified.

4. Safe harbour

If you act in good faith and follow this policy, we will not take legal action against you or ask anyone else to, and we will treat your research as authorised. In practice that means:

• test only against accounts you own or have explicit permission to use, and stop as soon as you have shown that the problem exists;
• if you reach someone else's data by accident, don't keep, copy or share it - tell us in your report what you saw;
• don't change or delete data, and don't try to keep access after you've reported;
• give us a reasonable time to fix the problem before you talk about it publicly - we aim for 90 days and will agree a date with you.

This safe harbour covers AnyMail only. It cannot authorise testing of our customers' systems or of third parties, and it does not override the law. If you are unsure whether something is allowed, ask us first at security@anymail.tech.

5. What happens after you report

• we confirm we received your report within 3 business days;
• within 10 business days we tell you whether we can reproduce it and how serious we think it is;
• we keep you updated while we fix it, and tell you when the fix is live;
• with your permission, we credit you by name once the issue is resolved.

We don't run a paid bug bounty programme at the moment, so we can't offer money for reports. We will always say thank you.