Security

Reporting

Email security@comail.team with a description of the issue and, if possible, steps to reproduce. If it contains sensitive details, contact us first to arrange a secure way to share the report.

Include a way to reach you. We'll acknowledge receipt within two business days and follow up with a triage timeline.

Scope

• The relay endpoints under smtp.atmos.email, atmospheremail.com, and comail.at.
• The cooperative labeler at labeler.atmos.email.
• The comail source code published on Tangled.

Out of scope: rate limiting that's working as intended, best-practice recommendations without a concrete attack, and reports against third-party infrastructure we don't operate (hosted PDSes, upstream MTAs, ISP-level filtering).

Our commitments

• We will not pursue legal action against researchers who act in good faith: testing only their own account, avoiding other members' data, and giving us reasonable time to fix the issue before publishing.
• We will credit reporters publicly in the fix changelog unless they ask to remain anonymous.
• For issues that affect member data confidentiality, we will notify affected members without undue delay once a fix is deployed and the disclosure window has elapsed.

Past advisories

None published yet. When we ship our first coordinated disclosure it will appear here with a CVE link (where applicable) and a summary of impact.