test / test (push) Has been cancelled
No exploitable findings across inbound relay, DMARC ingestion, auto rate limiting, auth-IP allow-lists, and the new panel surface. Two deliberate behaviours the pass examined are now recorded as accepted risks: unauthenticated DMARC report ingest and fail-open auth-IP enforcement. This closes the note that the inbound-relay path awaited its own review. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>