eerawlog is a command-line viewer for EmailEngine logs. It reads NDJSON (Pino) log lines from stdin and pretty-prints selected entries, including base64-encoded raw IMAP socket traffic that EmailEngine captures when run with EENGINE_LOG_RAW=true. That raw traffic originates from remote IMAP servers, which may be malicious or buggy, and the decoded bytes are written to the operator's terminal. Because eerawlog processes untrusted input and renders it to a terminal, we take security reports seriously and aim to respond quickly.

Security fixes are released only against the latest version. We do not backport patches to older releases - upgrading to the current release line is the supported way to receive security updates.

If you are on an older version, please upgrade. See the release notes at https://github.com/postalsys/eerawlog/releases before updating.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report privately through one of the following channels:

1. GitHub Security Advisories (preferred). Open a private report at https://github.com/postalsys/eerawlog/security/advisories/new. This keeps the discussion private until a fix is published and lets us credit you.
2. Email. Send details to andris@postalsys.com (the contact listed in SECURITY.txt). Encrypt sensitive details with the PGP key referenced there if possible.

When reporting, please include as much of the following as you can:

• The affected version(s) and environment (eerawlog version, Node.js version, OS, and terminal emulator).
• The component involved (e.g. the NDJSON line parser, the base64 raw-socket decoding, the terminal rendering/coloring, or the --filter.* matching).
• A clear description of the issue and its impact (e.g. terminal escape or control-sequence injection from decoded raw traffic, a parser crash or hang, memory exhaustion or denial of service from malformed or oversized log lines, or prototype pollution).
• A minimal proof of concept or reproduction steps - ideally a sample log line (with credentials and tokens redacted) or a short script that triggers the issue.
• Any suggested remediation, if you have one.

We are a small team, so there is no guaranteed response time - sometimes reports are handled within hours, sometimes they take longer. Accepted issues are fixed in a new release and coordinated through a GitHub Security Advisory, and reporters who wish to be named are credited.

We track and disclose vulnerabilities through GitHub Security Advisories. We do not request or manage CVE identifiers ourselves. If you need a CVE assigned for a reported issue, please request one yourself - for example, through GitHub's own CVE request flow on the published advisory, or another CNA.

In scope: the eerawlog source in this repository - the per-line NDJSON parser (including handling of malformed or oversized lines), the base64 decoding of raw IMAP socket traffic, the terminal rendering path that writes decoded server and client bytes to stdout (including handling of embedded escape/control sequences), and the --filter.* argument matching.

Out of scope:

• Vulnerabilities in EmailEngine itself, or in the IMAP servers whose traffic appears in the logs (please report those to their respective projects).
• The content of the logs you feed in. EmailEngine logs may contain credentials, access tokens, or message data; keeping those logs and their storage secure is the operator's responsibility, not a vulnerability in eerawlog.
• Vulnerabilities in your terminal emulator's own handling of escape or control sequences, or in third-party dependencies (please report those to their respective maintainers; we will upgrade once a fix is available).
• Issues that require an already-compromised host or local access to the machine running eerawlog.
• Social-engineering reports and theoretical issues without a demonstrated, concrete impact.

Thank you for helping keep eerawlog and its users safe.