hMailServer

The git repository is public on GitLab: https://gitlab.com/Progressiverobot/hmailserver

The repository is git on GitLab, which records every change, its author and its date: https://gitlab.com/Progressiverobot/hmailserver/-/commits/master

The public repository carries every interim commit between releases, not only releases: changes land on master commit by commit (more than a hundred since 22 September 2026), each with its diff, author and date, and releases are marked by tags. https://gitlab.com/Progressiverobot/hmailserver/-/commits/master

The repository is git, a distributed version control system, hosted on GitLab: https://gitlab.com/Progressiverobot/hmailserver

Each release has its own version number, stamped into the binaries (Version.h) and named by its tag and release page. https://gitlab.com/Progressiverobot/hmailserver/-/releases

Releases use Semantic Versioning, MAJOR.MINOR.PATCH (for example 6.3.0, 6.3.1, 6.3.2, 6.3.3). https://gitlab.com/Progressiverobot/hmailserver/-/releases

Each release is identified by a git tag v<version> (v6.3.0, v6.3.1, ...), and v* tags are protected on GitLab. https://gitlab.com/Progressiverobot/hmailserver/-/tags

Every release has human-readable notes, not a git log: on its GitLab release page, and in CHANGELOG.md, which has a section per release. The 6.3.4 section opens with what changes on upgrade without a switch. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CHANGELOG.md and https://gitlab.com/Progressiverobot/hmailserver/-/releases

The release notes name the vulnerabilities each release fixes. 6.3.4's section describes the JScript code-execution fix, for which a CVE has been requested through GitLab's CNA; the SMTP smuggling rule is recorded against CVE-2023-51764. SECURITY.md commits to quoting the CVE ID in the release notes. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CHANGELOG.md

Bug reports go to GitLab issues, with Bug, Feature, Question and Security templates. SUPPORT.md says what to include and that security reports go by the routes in SECURITY.md instead. https://gitlab.com/Progressiverobot/hmailserver/-/issues and https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SUPPORT.md

GitLab issues is the project's issue tracker, with labels for area, type and workflow state: https://gitlab.com/Progressiverobot/hmailserver/-/issues

The maintainer acknowledges reports. On GitLab (since 22 September 2026) both reports from outside the project have been acknowledged: bug report #2 was answered, and enhancement request #1 was labelled and assigned. Earlier reports were answered on GitHub, but that history cannot be reached while GitHub is suspended. https://gitlab.com/Progressiverobot/hmailserver/-/issues

Enhancement requests are GitLab issues with the enhancement label. The tracker moved here on 22 September 2026, so it holds no request from 2 to 12 months ago; the GitHub tracker that did has answered 404 since 18 September 2026. The one outside request since then, #1 of 24 September 2026, was labelled and assigned the day it arrived and has no written reply yet. https://gitlab.com/Progressiverobot/hmailserver/-/issues/1

All issues, open and closed, and the responses to them are public and searchable on GitLab: https://gitlab.com/Progressiverobot/hmailserver/-/issues/?state=all

SECURITY.md publishes the process: the two private routes, what to include, the response targets and coordinated disclosure. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md

Report privately through a confidential GitLab issue (the Security template), or by email to the project's Service Desk address, contact-project+progressiverobot-hmailserver-86730559-issue-@incoming.gitlab.com, which GitLab files as a confidential issue and needs no GitLab account. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#reporting-a-vulnerability

No vulnerability report from outside the project has been received on GitLab (the one security issue, #43, is the project's own), and none is known from GitHub's private advisories before 18 September 2026, which are out of reach now; SECURITY.md commits to acknowledging a report within 5 working days and assessing it within 10. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#what-to-expect

build/build.ps1 builds the Windows server (hMailServer.sln, MSBuild), the .NET tools (dotnet SDK) and the installer. The Linux server and its .deb and .rpm build with CMake and Ninja from hmailserver/source/Server/CMakeLists.txt (build/ci/linux-build.sh). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/build/build.ps1

Common tools only: MSBuild and the .NET SDK on Windows, and CMake with Ninja and CPack on Linux. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/CMakeLists.txt

The regression suites are in the repository under AGPL-3.0-or-later: hmailserver/test/RegressionTests (NUnit, 3,698 tests driving a running server over SMTP, IMAP, POP3, REST and COM) and hmailserver/test/LinuxRegressionTests (the same fixtures over REST against a Linux server). CONTRIBUTING.md's Testing section says how to set up the bench and run both. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#testing

The Linux suite and the .NET unit tests run with the language's standard command, dotnet test (for example dotnet test hmailserver/test/LinuxRegressionTests -c Release). The Windows suite, which needs the service registered on a bench, runs under NUnit's console runner through build\run-tests.ps1, as CONTRIBUTING.md's Testing section documents. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#testing

The Windows regression suite has 3,698 tests across SMTP, IMAP, POP3, TLS, authentication, anti-spam, virus scanning, the REST API, the COM API and the webmail, and a run of the whole suite covered 73.48% of the native server's lines (67,790 of 92,260, OpenCppCoverage, 15 September 2026). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md

Changes are integrated on batch branches and fast-forwarded to master, and every batch lands only after the maintainer's own full regression gate on the result: the whole Windows suite split across two machines, plus the whole Linux suite. .gitlab-ci.yml defines the same builds and suites on the project's own runners (linix, bench150) for master, batch* and v* tags, but no full pipeline has run on GitLab yet (issue #21); until 18 September 2026 GitHub Actions ran them. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md

CONTRIBUTING.md requires a change of behaviour to add or update regression tests and a fix to ship with a test that fails against the build before it, and the merge-request template asks that new behaviour be covered by a regression test. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#merge-requests

The major changes since 6.3.3 arrived with their tests: 131 new files in hmailserver/test/RegressionTests, 123 of them test fixtures, among them EncryptionAtRest.cs, SecretsAtRest.cs, PstImport.cs, RoomsAndEquipment.cs, InboundWebhooks.cs, SnmpAgent.cs, ObjectStorage.cs, NewInstallDefaults.cs and EventsJavaScript.cs; the JScript escaping fix came with tests that fail against the unfixed server. https://gitlab.com/Progressiverobot/hmailserver/-/tree/master/hmailserver/test/RegressionTests

The instructions for change proposals, CONTRIBUTING.md's 'Merge requests' section, say to add or update regression tests for a change of behaviour, and the merge-request template's checklist asks that new behaviour be covered by a regression test. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#merge-requests

The native server, the updater and the minidump helper compile with MSVC warning level 3 and warnings as errors (/WX) in Debug and Release (the .vcxproj files), and CONTRIBUTING.md's build commands build the .NET projects with -warnaserror. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#code-style-and-licence-headers

Warnings cannot accumulate in the native code: /WX makes any warning in the server's own code fail the build, so it is fixed before a change lands; the .NET projects are built with -warnaserror by CONTRIBUTING.md's commands and the merge-request checklist. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#code-style-and-licence-headers

The Windows build holds the server's own code to MSVC /W3 with /WX (vendored zlib alone is compiled at /W1), and the .NET projects are built with -warnaserror; moving a codebase of this age to /W4 would need mass suppression, and the Linux build adds no warning flags of its own. Beyond compiler warnings, cppcheck and clang-tidy (bugprone, cert, clang-analyzer and concurrency checks) were run over the sources on 25 September 2026 and their findings committed as a baseline, against which the CI job reports any new finding (allow_failure until the baseline is triaged). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CONTRIBUTING.md#code-style-and-licence-headers

ASSURANCE-CASE.md section 5 applies the secure design principles to this server: economy of mechanism, complete mediation, fail-safe defaults, least privilege, defence in depth and separation of secrets, set against its threat model and trust boundaries B1-B6. New installations are secure by default: STARTTLS, TLS required for authentication and a self-signed certificate (hmailserver/docs/SecureDefaults.md). SCRAM-SHA-256 and Argon2id, scrypt and PBKDF2 password hashing are available. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md#5-argument-secure-design-principles-are-applied

The maintainers document the common vulnerability classes for a mail server, each with its countermeasure, in ASSURANCE-CASE.md section 6: injection (CWE-89), memory corruption, SMTP smuggling (CWE-444), broken authentication, weak randomness, certificate validation, resource exhaustion and supply chain. CONTRIBUTING.md requires parameterised SQL and warning-free builds (/WX). The cppcheck, clang-tidy and Semgrep jobs are defined in .gitlab-ci.yml but have not run on GitLab yet. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md#6-argument-common-implementation-weaknesses-are-countered

Only published, reviewed algorithms and protocols are used: TLS 1.2 and 1.3, AES-GCM, ChaCha20-Poly1305, ECDHE with X25519 and the ML-KEM hybrids, PBKDF2, Argon2id, scrypt, SCRAM-SHA-256, DKIM with RSA-SHA256 or Ed25519 (RFC 8463), and SNMPv3 USM (HMAC-SHA-256, AES-128). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/ASSURANCE-CASE.md

The server calls OpenSSL for its cryptography - TLS, hashes, PBKDF2, Argon2id and scrypt, DKIM signatures and random numbers - and implements no primitive itself. The Windows build uses OpenSSL 4.0.x, built by libraries/build-openssl.ps1, and the Linux build the distribution's OpenSSL 3 or later; on Windows, stored secrets are protected with the operating system's DPAPI. The webmail's S/MIME and OpenPGP use the browser's Web Crypto API. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/libraries/build-openssl.ps1

Every cryptographic function can be had from FLOSS: the server uses OpenSSL (Apache-2.0) in both builds, and the Linux edition uses nothing else. The Windows edition also uses the operating system's DPAPI for stored secrets, which the Linux edition does with OpenSSL AES-256-GCM (DataProtector.cpp). https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/Util/DataProtector.cpp

The defaults meet NIST's 2030 minimums. A new installation's self-signed certificate and generated DKIM keys are RSA 2048 or larger (NewInstallDefaults.cpp, DkimKeyPair.cpp), and Ed25519 DKIM keys are supported. TLS ciphers are 128-bit or stronger with the default groups X25519MLKEM768, SecP256r1MLKEM768, X25519, P-384 and P-256, and SNMPv3 uses AES-128. Shorter keys are turned off through SslCipherList and TlsKeyExchangeGroups. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/Application/NewInstallDefaults.cpp

The default security mechanisms do not use MD4, MD5, single DES, RC4 or Dual_EC_DRBG. The default cipher list excludes DES, 3DES and MD5, and the RC4 names it still carries from upstream match nothing, because the OpenSSL build (libraries/build-openssl.ps1) keeps its default of no weak SSL ciphers. The server will not store a password as MD5, and POP3's APOP and CRAM-MD5 are not implemented. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/TCPIP/SslContextInitializer.cpp

The defaults do not depend on seriously weak algorithms. The default cipher list excludes DES, 3DES, MD5, export and null ciphers and lists ECDHE with AES-GCM first; TLS 1.3 is AEAD only; and the AEAD-ONLY preset removes the remaining CBC and SHA-1 HMAC suites. DKIM signs with SHA-256 by default and treats rsa-sha1 signatures as failing (RFC 8301) unless DkimAcceptSha1 is set. Passwords are hashed with PBKDF2 by default. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/AntiSpam/DKIM/DKIM.cpp

Forward secrecy is implemented. TLS 1.3 is always ephemeral, and the default TLS 1.2 list puts the ECDHE and DHE suites first, over the groups X25519MLKEM768, SecP256r1MLKEM768, X25519, P-384 and P-256; the server enforces that order when its prefer-server-ciphers option is on, which is off by default. The default list still ends with static-RSA suites for old clients; the AEAD-ONLY preset of SslCipherList removes them. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/TCPIP/SslContextInitializer.cpp

Account passwords are stored as salted, key-stretched hashes: PBKDF2 by default, or Argon2id or scrypt, with salts from OpenSSL's RAND_bytes. The server will not store a new secret under None, Blowfish or MD5; it logs the misconfiguration and uses PBKDF2. Salted SHA-256, the upstream scheme, can still be chosen explicitly. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp

Keys, nonces and secrets come from OpenSSL's CSPRNG (RAND_bytes, each call checked): password salts, SCRAM nonces, TLS ticket keys, app passwords, TOTP secrets, API keys and DNS transaction IDs. GUIDs come from the operating system's random source. The seeded generator is used only for MIME boundaries and OpenTelemetry trace IDs, which are not security mechanisms. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/source/Server/Common/Util/Hashing/HashCreator.cpp

Source and releases are delivered only over HTTPS (or SSH for git) from gitlab.com: the repository, and the release files on the GitLab release pages, served from the project's package registry. https://gitlab.com/Progressiverobot/hmailserver/-/releases

No hash is fetched over plain HTTP: release files and their SHA-256 values (in each release's notes, and the Linux SHA256SUMS file) come over HTTPS from the GitLab release pages. The Windows installer is Authenticode-signed from 6.3.1 on, and every file of 6.3.0 to 6.3.3 also has a Sigstore bundle; 6.3.4 is Authenticode-signed only, and the server's updater refuses to download a release it cannot verify. The build's third-party binaries are checked against SHA-256 values kept in git. https://gitlab.com/Progressiverobot/hmailserver/-/releases

No vulnerability of medium or higher severity known to the project is unpatched: the JScript escaping flaw, public since its fix reached master on 24 September 2026, and the installer's 7-Zip 19.00 (CVE-2023-31102, CVE-2025-55188), replaced by 26.03 on 25 September 2026, are both fixed in 6.3.4. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/CHANGELOG.md

The most serious vulnerability fixed in the last year, code run from a password on a Windows server using JScript event scripts with an OnClientValidatePassword handler, was fixed on master on 24 September 2026 by the review that found it (commit 5a3de9001) and is the security fix of 6.3.4 (CHANGELOG.md, 'Security and identity'). SECURITY.md commits to acknowledgement within 5 working days and a fix within 90 days. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md

The repository holds no credential that protects anything. The private keys and certificates are self-signed test fixtures: 'hmailserver/test/SSL examples', some regression tests, and installation/Extras/dh2048.pem, which holds DH parameters. The criterion permits such fixtures. No tokens, cloud keys or passwords are in tracked files; the one AWS-style key is Amazon's documented AKIAIOSFODNN7EXAMPLE, used in a signing test. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#secrets-and-credentials

cppcheck 2.19, clang-tidy (with the Clang static analyser's clang-analyzer-* checks) and Semgrep were run by hand on the project's runner over the tree of 25 September 2026, before 6.3.4, and their 1,307 and 85 findings are recorded in committed baselines (build/ci/static-analysis-baseline.txt, build/ci/semgrep-baseline.txt); cppcheck and clang-tidy read the sources the Linux build compiles, not the Windows-only ones. The static-analysis and semgrep jobs of .gitlab-ci.yml that run them are defined but have not yet run on GitLab; every release up to 6.3.3 was analysed by CodeQL on GitHub Actions, until 18 September 2026. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/ContinuousIntegration.md#security-scanning

clang-tidy runs the cert-, bugprone- and clang-analyzer-* check families (build/ci/clang-tidy.yaml), which look for common C and C++ weaknesses such as memory errors, unchecked conversions and unsafe functions, and Semgrep runs its open rule packs for C#, Python, JavaScript and shell, which include security rules. Until 18 September 2026 CodeQL's security queries also ran on GitHub. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/build/ci/clang-tidy.yaml

The first scan of 25 September 2026 was triaged the same day and its most serious findings in the server's own code were fixed on master before 6.3.4 (commit 9f414176f: 379 bare throw statements that would end the service, MIME boundaries from rand(), an uninitialised column); none was a confirmed exploitable vulnerability. The remaining findings are held in committed baselines while they are triaged, and SECURITY.md sets the rule for a confirmed one: high or critical fixed before merge, medium within 30 days. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/SECURITY.md#source-code-static-analysis

Before each minor release, RELEASE.md step 8c fuzzes every libFuzzer harness of the MIME parser, under AddressSanitizer, for 30 minutes on the release source, and the release notes record the run (6.3.0 and 6.3.2; a patch release with no parser change cites the previous run, as 6.3.1 did). Step 8b also runs the whole regression suite on the assertion build. https://gitlab.com/Progressiverobot/hmailserver/-/releases/v6.3.2

The C++ MIME parser is fuzzed with libFuzzer under AddressSanitizer before every minor release (RELEASE.md step 8c; fuzz/, docs/Fuzzing.md). Before each release, the whole regression suite also runs on the assertion build, with a crash oracle that fails a test on any swallowed access violation. The nightly fuzz job (linux-fuzz) and an ASan/UBSan job over snmp-tests (linux-sanitize) are defined in .gitlab-ci.yml but have not yet run on GitLab; nightly fuzzing ran on GitHub until 18 September 2026. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/hmailserver/docs/Fuzzing.md

RELEASE.md step 8b runs the whole regression suite on the assertion build (build.ps1 -Configuration Release -Asserts), which keeps every HM_ASSERT; a violated assertion is logged as HM6364 and fails the test. That build is never shipped. https://gitlab.com/Progressiverobot/hmailserver/-/blob/master/RELEASE.md

Every fuzzing finding has been fixed and its input kept in fuzz/regression, which every fuzz run re-executes: two heap-buffer-overflow reads, a new/delete mismatch and a non-terminating encoder loop in the MIME parser (August 2026), and a heap over-read the first Linux replay found on 25 September 2026. RELEASE.md makes a fuzzing crash or a violated assertion a release blocker. https://gitlab.com/Progressiverobot/hmailserver/-/tree/master/fuzz/regression