Block a user
Run container as non-root user
Fix POP3/SMTP correctness and IMAP robustness
lyrathorpe
created branch docs/security-note in lyrathorpe/legacy-email-proxy
2026-06-17 17:22:33 +01:00
lyrathorpe
created branch ci/pip-cache-ordering in lyrathorpe/legacy-email-proxy
2026-06-17 17:22:32 +01:00
lyrathorpe
pushed to fix/pop3-smtp-correctness at lyrathorpe/legacy-email-proxy
2026-06-17 17:22:32 +01:00
lyrathorpe
pushed to ci/pip-cache-ordering at lyrathorpe/legacy-email-proxy
2026-06-17 17:22:32 +01:00
lyrathorpe
pushed to chore/dockerfile-non-root at lyrathorpe/legacy-email-proxy
2026-06-17 17:22:30 +01:00
lyrathorpe
created branch chore/dockerfile-non-root in lyrathorpe/legacy-email-proxy
2026-06-17 17:22:29 +01:00
lyrathorpe
created branch fix/pop3-smtp-correctness in lyrathorpe/legacy-email-proxy
2026-06-17 17:22:28 +01:00
Document that the front-end POP3/SMTP is unauthenticated and must be network-restricted
Pip cache step runs after install and key is never expanded
Run the container as a non-root user
Implement POP3 TOP command
Backend IMAP calls block the event loop and have no timeout
SMTP relay corrupts 8-bit message content
POP3 RETR is missing dot-stuffing and CRLF termination
POP3 DELE marks are wiped by STAT/LIST/UIDL
POP3 RETR drops the message body (returns empty message)