Skip to content

Security: ilfrick/frickmail

Security

SECURITY.md

Security Policy

Frickmail-specific notes

Frickmail is a fork of upstream SnappyMail. Most of the surface area is upstream code, so most security disclosures should go upstream first using the email/PGP key below.

For issues in Frickmail-only code — plugins/login-gmail, plugins/login-o365, plugins/login-oauth2, the Docker image, the contacts/calendar plugins, or anything under docs/ — open a private security advisory at https://github.com/ilfrick/frickmail/security/advisories/new.

Currently tracked upstream advisories

ID Affected versions Status in Frickmail
GHSA-2rq7-79vp-ffxm / CVE-2024-45800 (mXSS in HTML sanitizer) < 2.38.0 Patched (Frickmail ships SnappyMail 2.38.2 which includes the fix)

Frickmail tracks upstream master. Our last sync point is upstream commit c154d23 (2026-03-11). Run git log --grep=security and git log --grep=CVE on this repository for the audit trail of patches we've integrated.

Frickmail-specific hardening guidance

  • Prefer the public PKCE flow shipped by the OAuth2 plugins (no client_secret). If you do set a secret, store it in FRICKMAIL_*_CLIENT_SECRET env vars rather than the admin UI.
  • HTTPS is mandatory for OAuth2 redirect URIs. Google and Microsoft will refuse to complete consent over plain HTTP.
  • The Docker volume /var/lib/snappymail contains mailboxes, cached refresh tokens and the admin password — back it up encrypted.

Upstream SnappyMail policy

Supported Versions

Currently due to the fast development only the latest version receives security updates.

Version Supported
2.34.x ✔
< 2.34.0 ❌

Reporting a Vulnerability

Please report security issues or vulnerabilities as an encrypted email to security@snappymail.eu. Your report should be detailed enough with clear steps to reproduce and classify the found vulnerability.

You can find the PGP public key below and on the major public keyservers like keys.openpgp.org.

-----BEGIN PGP PUBLIC KEY BLOCK-----
Comment: Type: 255-bit EdDSA
Comment: Fingerprint: 445D265124E6072671E64D0733F868A7E35E8277

mDMEYiE2QRYJKwYBBAHaRw8BAQdAqMrQUm6DddWcQNo0VEjNIu3Q6CfP3nokVv2Y
rNQ1avq0LFNuYXBweU1haWwgU2VjdXJpdHkgPHNlY3VyaXR5QHNuYXBweW1haWwu
ZXU+iJQEExYKADwWIQREXSZRJOYHJnHmTQcz+Gin416CdwUCYiE2QQIbAwULCQgH
AgMiAgEGFQoJCAsCBBYCAwECHgcCF4AACgkQM/hop+NegnfSGgD9GEHpOrvWpBGY
dYfvVd/+Lv5d+dFBcPyki9zu9zHfhwkBAL343EF6ZR0XwMlOQu9wu0hT9KBz4g55
6D41i0PrEaoBuDgEYiE2QRIKKwYBBAGXVQEFAQEHQMMr9gcVcJ3aiup/tpl8ZXxy
aJiJRGkPyNwGI5vxHMpZAwEIB4h4BBgWCgAgFiEERF0mUSTmByZx5k0HM/hop+Ne
gncFAmIhNkECGwwACgkQM/hop+NegndVhgD/SVGSKbF4G2W024VpW2tm3zCT+ue+
YMXQVq4SJt7UpWABAORudfJxsBqCRKtPlZMgGTJLjcOkyFJ9C2Fx7DeN0J4I
=nSOi
-----END PGP PUBLIC KEY BLOCK-----

Publishing and Credits

I will analyze and fix the reported issue as fast as possible. Together with the reporter I plan the disclosure of the found and fixed vulnerability. Credits to the reporter are granted and can be included in all public communication if desired.

There aren't any published security advisories