Security Model

Security Model

Inbound confidentiality

• The Worker encrypts mail with a random AES-256-GCM data key.
• The data key is wrapped with the Mailbridge RSA public key using RSA-OAEP SHA-256.
• Only ciphertext is stored in R2.
• Only object references are sent through Cloudflare Queues.
• The private key remains on the Mailbridge host.

Authentication

• Inbound webhook calls require WEBHOOK_SECRET.
• Cloudflare Email Service outbound calls use CLOUDFLARE_SEND_WEBHOOK_SECRET when configured.
• Keep the inbound and outbound secrets distinct.

Retry queue

• Queued message files are encrypted with AES-256-GCM.
• Each message has independent secret material stored in secrets/secrets.db.
• QUEUE_MASTER_KEY is required to derive message keys.
• The audit database stores hashes and event metadata rather than raw mail bodies.

SMTP relay

• Disabled by default.
• Restricted by SMTP_RELAY_ALLOWED_CIDRS.
• STARTTLS is required by default.
• Plaintext operation requires an explicit insecure override.
• SMTP DATA is capped by SMTP_RELAY_MAX_MESSAGE_BYTES.
• The relay has no username/password authentication; network allowlisting is therefore a critical boundary.

Filtering posture

• Spam-filter failures are fail-closed unless SPAMC_FAIL_OPEN=true is explicitly selected.
• Spamhaus and AI screening are disabled by default.
• AI input scope defaults to headers, minimizing mail content sent to an optional provider.

Never commit .env, wrangler.toml with live settings, data/, secrets/, private keys, tokens, or provider credentials.

For vulnerability reporting, see the repository Security Policy.