It had none: no security policy, no contributing guide, no code of conduct,
no sponsor link, and no CI. A public repository with an administrative
interface in it should at least say where to send a vulnerability, so that
part names what is worth reporting here specifically -- a session acting
beyond its permissions, one tenant's data reaching another, a token landing
somewhere that outlives the session -- and where a report goes if it turns
out to belong to the server or to upstream.
CI is what a contributor can run: typecheck, lint, test, build. Nothing in
it needs a live server, so a red run means the code, not the runner.
- One edition: whatever edition the server reports, nothing is hidden or
disabled as Enterprise-only (accountStore.setAccountInfo).
- INBUXA branding: name, logo (mark plus a text-colored wordmark), favicon,
page titles, setup wizard text, and ihasmail's palette in light and dark.
- Two-factor setup names INBUXA as the issuer and drops the image parameter
that made authenticator apps fetch a logo from a third-party site.
- Runs apart from the server: the server address can be set at deploy time
with <meta name="api-base-url">, and OAuth endpoints the server returns as
relative paths are resolved against the server's address, not the page's.
Verified end to end against a separate inbuxa-server.
- Upstream's release workflow moved to .github-upstream so it never runs.
Upstream's history contains no Enterprise-only code, so this is an ordinary
fork. upstream is a fetch-only remote.
jcoffey-dev
Maurus Decimus