Help

Security.

Sessions, app passwords, and vulnerability reports.

Sign-in uses Stalwart OAuth with PKCE. Tokens stay in HttpOnly cookies. Settings → Security lists web sessions this app issued.

App passwords are for IMAP/SMTP clients. Revoking a web session does not revoke an app password.

Report product vulnerabilities to security@zanonmail.com. There is no bug-bounty programme advertised.