Security posture

The wire path is hand-rolled C11

visage was given a deep wire-path security review before public launch (3 HIGH + 4 MEDIUM findings, all fixed, no CRITICAL). Where it stands:

• Wire memory safety — bounded per-connection buffers on the SMTP and admin paths; a reply-backlog cap (SMTP_IN_MAX_OUT 256 KB) + TCP backpressure; hard command-length limits.
• Reply tokens — 32 hex chars from /dev/urandom, no weak fallback (fail-closed), expiring after 30 days. Tokens are the reply feature's only credential.
• Admin API — constant-time bearer-token comparison; config-check rejects tokens that can never authenticate (>500 chars) and warns on weak defaults.
• Anti-injection — MAIL FROM and RCPT validated (printable ASCII, no quote/angle chars); no SMTP-envelope CRLF injection to the relay; mail with NUL/control bytes rejected (554).
• Relay integrity — starttls-verify does mandatory STARTTLS with CA + hostname verification and never falls back to plaintext or sends AUTH over it.
• Availability — inbound SMTP rate-bounded (512 conns global / 16 per-IP, 421 on excess); queue-driven relay sends batched (8/tick); null reverse-path preserved end-to-end (MAIL FROM:<>).
• Browser demo — remote http:// Dhall imports are compiled out of the wasm build, so a pasted config can't make your browser probe URLs.

The wasm demo stubs out http_fetch / url_dirname / url_join so no remote import ever issues an XHR — a hostile pasted config cannot SSRF from visitor browsers.