EMLyzer is designed with security-first principles:

• Offline-first analysis — All email parsing and analysis runs locally; no data is sent externally by default
• No cloud dependencies — Core functionality requires no internet connection or API keys
• Optional reputation services — External API integrations (AbuseIPDB, VirusTotal, etc.) are entirely optional and user-configured
• Local-first database — SQLite database stores results locally on disk
• Transparent threat analysis — All detection logic is open-source and auditable

• ❌ No user accounts or authentication required
• ❌ No telemetry or usage tracking
• ❌ No data collection or analytics
• ❌ No cloud processing or storage
• ❌ No third-party tracking scripts

• ✅ All email data stays on your machine
• ✅ You control which reputation services are used (or use none)
• ✅ You own your analysis database
• ✅ You can delete analyses at any time
• ✅ Full source code transparency

• Uses trusted, audited parsing libraries: mail-parser (EML) and extract-msg (MSG)
• Input validation on all parsed email fields
• HTML/JavaScript sanitization using bleach to prevent XSS in body analysis
• Safe handling of MIME encodings and nested structures

• Domain and IP address extraction and validation
• Punycode detection (homoglyph spoofing prevention)
• WHOIS and DNS queries use read-only lookups (no modification)
• Shortener detection and redirect chain analysis
• No automatic navigation to URLs (reporting only)

• By design: Attachments are NOT executed
• Hash computation (MD5, SHA1, SHA256) for integrity verification
• MIME type validation against file extension
• Detection of embedded macros and JavaScript in documents
• Stream analysis for suspicious PDF patterns

• Optional and configurable per service
• API keys stored locally in .env (not synced to git)
• All reputation lookups are read-only queries
• Rate limiting respected (no brute-force scanning)
• Requests authenticated with user-provided credentials only

EMLyzer does not implement an authentication/login system. Starting with v0.17, some endpoints modify configuration that affects the risk verdict of analyses (forcing a feed refresh, creating/editing a known campaign, approving an auto-generated proposal):

• Network default: start.sh/start.bat now listen on 127.0.0.1 (loopback) by default, no longer 0.0.0.0. Exposing the app on other interfaces is an explicit opt-in (EMLYZER_BIND=0.0.0.0) and prints a console warning.
• Local admin token: endpoints that write configuration (POST /api/intel/refresh, POST/PUT/DELETE /api/campaigns/known/*, POST /api/campaigns/proposals/*) accept requests from localhost without any token; from any other address they require the X-EMLyzer-Token header, generated at first startup and saved to backend/data/admin_token (never in git). This is not a full authentication system: if you expose the instance beyond localhost, put a reverse proxy with its own authentication in front of it.
• External feeds: downloading IOC feeds (OpenPhish, Spamhaus, URLhaus) and the CERT-AGID RSS bulletin uses URLs hardcoded in the code (never configurable via the API or .env), with a size cap, dedicated timeout/deadline, and rejection of redirects toward private/loopback addresses — defending against SSRF even if one of these domains were ever compromised.
• Data persisted for the backtest: if INTEL_STORE_CAMPAIGN_SURFACE is enabled (default), each analysis saves normalized, filtered (basic anti-PII) tokens of the email text to body_indicators.campaign_surface, used only to validate new campaigns against the historical corpus. Disable it in .env.

• Uploaded emails: stored in backend/uploads/ — deleted after analysis
• Generated reports: stored in backend/reports/ — deleted when removed via UI
• SQLite database: persists in backend/data/emlyzer.db — user controls deletion

If you discover a security vulnerability in EMLyzer:

1. Do not open a public GitHub issue — This exposes the vulnerability
2. Use GitHub Security Advisory:
   • Navigate to: https://github.com/overwrite00/EMLyzer/security/advisories
   • Click "Report a vulnerability"
   • Describe the vulnerability in detail

• 48 hours: We will acknowledge receipt of your report
• 2 weeks (critical): Target fix timeline for critical vulnerabilities
• 30 days (high): Target fix timeline for high-severity vulnerabilities
• Coordinated disclosure: We will work with you on a disclosure timeline

We appreciate responsible disclosure and will credit you in our security advisory (unless you prefer anonymity).

• Prevents spear-phishing if you visually trust the sender — EMLyzer detects technical indicators but cannot override human judgment
• Executes attachments — By design, EMLyzer analyzes attachments without running them (safe-by-default approach)
• Performs OCR on images — Scanned PDFs or image-based phishing are not analyzed (future enhancement)
• Detects zero-day exploits — Reputation services have detection delays; new threats may not be flagged
• Guarantees 100% accuracy — Like all security tools, false positives and false negatives can occur

EMLyzer is one layer of email security. For comprehensive protection, also use:

• Email gateway filters (at your email provider)
• DMARC/SPF/DKIM enforcement
• Endpoint protection software
• User security training
• Email authentication (2FA/MFA)

Planned improvements (see CHANGELOG.md for full roadmap):

• YARA rule engine for custom threat detection
• PostgreSQL support for enterprise deployments
• Plugin system for custom analyzers
• Machine learning model improvements
• Automated malware signature updates

• Subscribe to releases: Watch the Releases page
• Check security advisories: GitHub Security Advisory
• Update regularly: Use the latest version for security patches

• Code of Conduct — Community guidelines
• Contributing Guide — How to contribute securely
• REQUIREMENTS.md — Dependency information
• CHANGELOG.md — Version history and security fixes

Last updated: 2026-06-07 ← Contributing | Back to README →