Zero Mail handles Gmail OAuth tokens and email content, so we take security reports seriously.

Please do not open a public issue for security problems.

Report privately through GitHub: Security → Report a vulnerability.

Include what you can: affected component (backend/api, backend/worker, apps/web, apps/admin), steps to reproduce, and the impact you expect.

We aim to acknowledge reports within 3 business days and to ship a fix or mitigation for confirmed high-severity issues as quickly as possible. We will credit reporters in the advisory unless you ask us not to.

Only the latest main branch is supported with security fixes.