Security design
- OAuth authorization uses the system browser, PKCE, state validation, and a loopback redirect.
- OAuth refresh tokens use macOS Keychain on macOS, or Electron safeStorage on Windows and Linux where OS encryption is available; otherwise the app falls back to memory-only storage for that runtime. See the Privacy Policy for the full description.
- The renderer uses context isolation, sandboxing, and disabled Node.js integration.
- Privileged operations pass through a typed, allowlisted Electron IPC surface.
- Runtime credentials stay outside the repository and bundled application.
- Remote images can be blocked and likely tracking pixels are stripped.
Report a vulnerability
Do not post tokens, credentials, private email, or exploit details in a public issue. Use GitHub private vulnerability reporting when available.
Open a private security advisory ↗
If private reporting is unavailable, open a public issue containing only a minimal description and ask for a private disclosure path.
Supported version
Dumka Mail is early-alpha software. Security fixes are applied to the default branch. Use the latest available build and review release notes before upgrading.