If you believe you have found a security issue in the ASMTP specification or in the reference operator in this repo, please report it privately.
For protocol-level issues — a wire-format ambiguity that an attacker could exploit, a privacy invariant the spec fails to guarantee, a denial-of-service shape the spec admits — please email the spec maintainers (see this repo's README.md for contact channels) rather than filing a public issue.
For implementation-level issues in the reference operator (examples/local-operator/), the same private-disclosure preference applies.
ASMTP inherits identity and trust from ASP. Security concerns about agent authentication, allowlist enforcement, or block semantics should be reported to the ASP project. Concerns about how ASMTP composes with ASP — for example, whether an allowlist denial is correctly applied at envelope accept time — belong here.
The ASMTP spec specifies that per-envelope read state is visible only to the mailbox owner. Senders never see fetched or read facts. CC'd participants never see other recipients' read state. Operator admin tooling exposed to non-owners must not surface read state. If you find a way that this invariant leaks, that is a security-class issue and we want to know.