Security

What WireCat CLIs share — the keyring, permissions, MCP and what never reaches a log — is on the shared security page. This page keeps only what is particular to mail.

mail keeps its settings in config.json and its state in the folders mail doctor shows. It reads mail only from the IMAP server of each profile, over TLS or STARTTLS; a connection with no encryption is refused. It cannot send mail and never changes the mailbox. But memo has memo mail delete, which moves Gmail mail to Trash. An agent with write access to memo can change mail; an agent with only mail cannot.

session start on a new profile looks for the server of an address whose domain is not in its built-in table (Yandex, Gmail, iCloud, Mail.ru, Fastmail, Outlook). It sends the domain, never the full address, to three places: your DNS resolver, for the domain's MX record; Thunderbird's list of mail servers at https://autoconfig.thunderbird.net; and https://autoconfig.<domain>, the domain's own server. It stops at the first answer. --provider (a name in the table) or --host skips every lookup, and nothing leaves the computer before the login to that server.

The app password is typed at a terminal with no echo, or set in MAIL_PASSWORD for a run with no terminal. It goes to the OS keyring (service mail-cli, account the profile name) only after the server accepted it. It is never an argument, never part of a URL, never written to config.json, a log or a run record. When the keyring fails, it goes to credentials.json in mail's config folder instead, mode 600, and mail says so once on stderr; --credential-storage file chooses that file outright, which we do not recommend. session end forgets it. mail can read the old Himalaya entry; it never writes it.

A run with moved folders (MAIL_CONFIG_DIR and its neighbours, or a HOME or XDG folder away from your own) reads your mail-cli entry but never replaces or removes it; a password it stores goes to a temporary entry of its own. session end there removes only that temporary entry; on your password it removes nothing and answers "kept": "owners-sign-in".

Everything in a message is written by someone else: the subject, the body, the headers, the sender's name, folder names and file names. sync stores it as text and never follows a link or runs anything in it. Attachment bytes are not stored. An agent that reads synced mail must treat it as data, never as instructions.

mail ya mcp serve --http listens on 127.0.0.1 only, for browser apps that reach it through your own tunnel. Each app logs in with a one-time code, and the server keeps a hash of each login it gives, in the state folder, readable by you only. mail ya mcp revoke forgets every one of them.

A run record keeps the command line as you typed it, so mail runs show tells you what was run. A run record and an error message replace some text with [redacted]: the value of an option or a link that holds a token or a password, a token in a known format, a long random-looking string, and a phone number, also inside message text. A secret that looks like an ordinary word can stay, so do not type one. To keep none of the words you type, run mail personal config set record_input false.

config.json is saved readable by you only (0600), and its folder is created for you only (0700). A file or folder made by an older version may be open to other users of the computer: mail doctor lists each under files.problems and prints the chmod that fixes it. Windows is not checked. Report a vulnerability as SECURITY.md says.