This app serves private correspondence, so security reports are very welcome.

Only the latest release receives fixes.

Please do not open a public issue. Use GitHub's private vulnerability reporting or contact the maintainer on Telegram: @Kilax123.

Include steps to reproduce with synthetic data only. Never send real exports or databases.

• The password and HTTPS protect web access; files on disk are not encrypted by this project.
• The app is designed to listen on 127.0.0.1 behind nginx. Exposing port 8000 directly is not a supported configuration.