This experimental milestone has no production-supported releases. Parser bugs, malformed-input crashes, privilege mistakes and interference with mail processing are security-sensitive even on local Unix sockets.

Report sensitive findings privately to the project maintainers. Use GitHub private vulnerability reporting for this repository if enabled; otherwise contact the maintainer privately to arrange a secure report. Do not place credentials, private mail, exploit details or spool contents in public issues.

Include the plugin revision, exact Exim version, compiler, protocol revision and a minimal sanitized reproducer. See docs/security.md for the current trust boundary and limitations. No response-time or unverified support guarantees are made.