Please do not open a public issue. Use GitHub's private vulnerability reporting for this repository. You should get a response within a few days. Once a fix is released you will be credited in the advisory unless you prefer otherwise.

Security fixes go into the latest release.

• postmarkd can send mail as your domain. Treat access to its socket or port like access to your Postmark server token.
• Keep the default unix socket, or enable POSTMARKD_AUTH_TOKENS and put TLS in front of postmarkd before exposing it on a network.
• Load the Postmark token with a systemd credential rather than the config file or environment (see docs/configuration.md).