If you discover a security vulnerability, please report it by opening a GitHub issue with the security label. Do NOT open a public issue for security flaws that could expose user data.

We will acknowledge your report within 48 hours and work on a fix.

⚠️ This tool handles OAuth tokens and email passwords. Please follow these security best practices:

1. Never commit .env files — they contain passwords and token paths
2. Protect the tokens/ directory — OAuth tokens grant access to your email
3. Use file permissions: chmod 600 tokens/*.token
4. Never share log files — they may contain email content snippets
5. Rotate tokens by deleting the token file and reauthorizing periodically
6. Use a dedicated Azure App — don't reuse OAuth credentials from other apps