mixandClaude Opus 5.5 820b1bb968 docs: the upstream's Required TLS checks no certificate (audit M7) ...

Security audit 2026-10-17, finding M7 (low), stage 6; Help's mockup is
c09368c. postfix/inbound.go writes "encrypt" for Required, and Postfix
verifies no certificate at that level: a domain user who chooses it gets
privacy against passive observers only. The guide § Inbound relay and Help
(word for word with the mockup) say so. Offering "secure" with the
upstream's name is a choice for domain users and hours of work: it goes on
the roadmap as a proposal, not into this plan.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-17 22:34:29 +03:00

..

static

label-tag: a tag beside a label takes the label's line height

2026-10-17 14:02:51 +03:00

templates

user-reauth: the user form asks for your account password (audit A2)

2026-10-17 21:28:18 +03:00

testdata

backup-reauth: the account password before a backup or an export

2026-10-16 22:39:13 +03:00

account.go

password-reset: a confirmed e-mail, then a link to reset the password

2026-10-17 12:03:27 +03:00

cards_order_test.go

test-email: a test message from Server › Health

2026-10-17 00:42:21 +03:00

components_test.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00

components.go

health-setup-checks: the certificate's name, Postfix's greeting, the proxy

2026-10-16 23:51:42 +03:00

dmarc_test.go

dmarc-day, health-sockets: the reporter's day said; the inbound journal dialled

2026-10-17 13:38:34 +03:00

dmarc.go

dmarc-day, health-sockets: the reporter's day said; the inbound journal dialled

2026-10-17 13:38:34 +03:00

fixtures_test.go

domains: a domain's DMARC reports are deleted with it (audit A5/W2)

2026-10-17 21:52:06 +03:00

guard_html_test.go

panel-redesign: the design contract as guard tests and a design-first CI step

2026-10-09 17:19:42 +03:00

guard_panel_test.go

guard: panel - the reset and confirmation pages are signed-out screens

2026-10-17 11:14:46 +03:00

health.go

docs-audit: the guide and the panel's words against the code

2026-10-17 02:32:44 +03:00

help_test.go

docs-audit: the guide and the panel's words against the code

2026-10-17 02:32:44 +03:00

help.go

docs: the upstream's Required TLS checks no certificate (audit M7)

2026-10-17 22:34:29 +03:00

inbound_domain_test.go

docs-audit: the guide and the panel's words against the code

2026-10-17 02:32:44 +03:00

inbound_lists.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00

inbound_log_test.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00

inbound_log.go

inbound-upstream-result: the upstream's answer in the Inbound log

2026-10-16 16:35:09 +03:00

inbound_test.go

panel-redesign: Inbound domains, domain and delete on the kit; Spam filter box

2026-10-10 01:39:20 +03:00

inbound.go

docs-audit: the guide and the panel's words against the code

2026-10-17 02:32:44 +03:00

kit.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00

legacy_pages.txt

panel-redesign: the queue in the new shell; the old design is removed

2026-10-10 02:36:04 +03:00

outbound_app.go

web: Referrer-Policy same-origin; a password shown once emptied on pagehide

2026-10-15 01:04:45 +03:00

outbound_log_test.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00

outbound_log.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00

outbound_queue_test.go

panel-redesign: the queue in the new shell; the old design is removed

2026-10-10 02:36:04 +03:00

outbound_queue.go

panel-redesign: Help with seventeen topics; every box links to its own

2026-10-10 11:58:36 +03:00

outbound_test.go

domains: a domain's DMARC reports are deleted with it (audit A5/W2)

2026-10-17 21:52:06 +03:00

outbound.go

domains: a domain's DMARC reports are deleted with it (audit A5/W2)

2026-10-17 21:52:06 +03:00

overview_head_test.go

overview-head: the mockup's sentence, made from the cards

2026-10-17 12:48:34 +03:00

overview.go

overview-head: the mockup's sentence, made from the cards

2026-10-17 12:48:34 +03:00

pages_test.go

overview-head: the mockup's sentence, made from the cards

2026-10-17 12:48:34 +03:00

paneljs_test.go

backup-reauth: the account password before a backup or an export

2026-10-16 22:39:13 +03:00

server_test.go

password-reset: a confirmed e-mail, then a link to reset the password

2026-10-17 12:03:27 +03:00

server.go

user-reauth: the user form asks for your account password (audit A2)

2026-10-17 21:28:18 +03:00

signin_test.go

panel-redesign: sign-in without an administrator follows its mockup

2026-10-09 23:33:26 +03:00

signin.go

password-reset: a confirmed e-mail, then a link to reset the password

2026-10-17 12:03:27 +03:00

static_test.go

panel-redesign: security review of 2.0 - sessions belong to a user by id

2026-10-10 03:04:02 +03:00

static.go

store, web: cite the source of what they rely on (assumptions part D)

2026-10-14 19:36:26 +03:00

templates_test.go

password-reset: a confirmed e-mail, then a link to reset the password

2026-10-17 12:03:27 +03:00

view.go

password-reset: a confirmed e-mail, then a link to reset the password

2026-10-17 12:03:27 +03:00

zone_main_test.go

local-time: the panel in the container's zone, named on Settings

2026-10-17 01:34:28 +03:00