Porch Mail
Buy Porch Mail
SecurityDisclosure policy

Found a hole? Tell us first.

Porch Mail holds the keys to people’s email. If you find a way to get at mail, secrets or the computer it runs on, we want to hear about it, and we’ll treat you as someone helping.

security@porch.zeiq.dev
§01 · Reporting

Email us. Please don’t open a public issue.

Write to security@porch.zeiq.dev with the version (Settings → About), your system, the steps to reproduce it, and what an attacker gets. A proof of concept helps; a video is fine.

Test only against your own accounts and computers. Don’t read other people’s mail, keep what you touch to the minimum the report needs, and delete it afterwards. Research done that way, in good faith, is welcome: we won’t pursue or report you for it.

There’s no paid bounty yet. With your permission, we credit you in the release notes of the fix. This policy is also published as security.txt.

What happens next
3 working days
We confirm we have your report.
10 working days
We tell you whether we can reproduce it and how serious we think it is.
30 days
Our aim for a fixed release when the issue is critical or high. Others go into the next regular release.
90 days
The default before you publish, or sooner once the fix is out. We’ll agree a different date with you if a fix needs longer.
§02 · Scope

What we most want to hear about.

  • The desktop app and the daemon

    The local API and its tokens, anything that reaches it from another program or user on the same computer.

  • Email rendering

    Script, remote content or tracking that escapes the sanitiser or the content policy, and anything that gets out of the email’s page.

  • The image proxy

    Requests it can be made to send to private or local addresses, or to hosts it didn’t put in the page.

  • Accounts and secrets

    The OAuth flow, the keyring, and any secret written to disk, logs or the cache.

  • Agents, the CLI and MCP

    A token doing more than its scopes allow. Sending mail with any token is a bug.

  • Releases

    Anything that would let a tampered download pass the checks below.

Out of scope

  • Your mail provider’s own servers and sign-in pages. Report those to the provider.

  • Attacks that need root, or full control of your user account, already.

  • Findings on this static website with no real impact, such as missing headers or version banners.

  • Social engineering, physical access, and denial of service.

§03 · Verify a download

Check it came from us, unchanged.

Every release comes with SHA256SUMS, a signature over it (SHA256SUMS.minisig), and a software bill of materials in CycloneDX format: one for the npm packages inside the app, one for the Rust crates in the desktop binary. The Mac app is also signed with our Apple Developer ID and notarized by Apple.

  1. 01 · The checksums are ours

    With minisign (brew install minisign), in the folder you downloaded to:

    minisign -Vm SHA256SUMS -P RWSPN42jCDy1ITaiYmH5FMdELSR5R6NsN0M9exYN9KlosIHD/1nNl9B5

    Our public key: RWSPN42jCDy1ITaiYmH5FMdELSR5R6NsN0M9exYN9KlosIHD/1nNl9B5

  2. 02 · The file matches

    Then check the files you have against the signed list:

    shasum -a 256 -c SHA256SUMS --ignore-missing
  3. 03 · Apple agrees

    On a Mac, Gatekeeper checks the signature and notarization when you open the app. To check by hand:

    spctl -a -t open --context context:primary-signature -v Porch-Mail-*.dmg
codesign -dv "/Applications/Porch Mail.app" 2>&1 | grep Authority

    The first line should say accepted, and the authority Developer ID Application.