The following versions of ZapMail currently receive security updates:

We take security seriously. If you discover a security vulnerability in ZapMail, please do not open a public GitHub issue. Instead, report it privately using one of the following methods:

1. GitHub Private Security Advisory (preferred)
   Go to the repository → Security tab → Report a vulnerability.
   This keeps the details confidential until a fix is available.

2. Email
   Contact the repository maintainers directly through GitHub. Navigate to any contributor's profile and use GitHub's contact options.

Please provide as much of the following as possible:

• A clear description of the vulnerability and its potential impact
• Steps to reproduce the issue (proof-of-concept if possible)
• The affected branch/version
• Any relevant logs, screenshots, or request/response payloads (redact sensitive data)

We will keep you informed throughout the process and credit you in the release notes unless you prefer to remain anonymous.

This project uses the following automated security tools:

• Brakeman — static analysis for common Rails security vulnerabilities, run on every CI build.
• importmap audit — scans JavaScript dependencies for known vulnerabilities.
• Dependabot — automated dependency updates for Bundler and GitHub Actions.
• BCrypt — all user passwords are hashed with BCrypt before storage.
• JWT — API authentication tokens are signed with industry-standard JWT.

The following are generally considered out of scope for this project's security policy:

• Denial-of-service attacks against the live Heroku instance
• Social engineering of team members
• Issues in third-party services (Heroku, Sidekiq Cloud, OpenAI API)

Thank you for helping keep ZapMail secure!