smtp fixes database replays but strips key safeguards

One useful installation fix is bundled with removals that could break fresh deployments and weaken data protections.

securityinfrastructure

smtp has made an older set of database updates safer to replay from scratch, preventing setup failures when a later change has already removed information an earlier update expected to find.

But the same change removes several newer database updates without explanation, including protections and features for:

  • Audit logging, including restrictions on who can read those records.
  • Narrower high-privilege access, limiting damage if credentials leak.
  • Microsoft Word chat support and workflow changes.
  • User-record integrity and consistent project-sharing email addresses.

The application still appears to rely on some of the removed pieces. That means a new installation could have broken audit or Word-related features, while an existing deployment may lose important access controls.

Teams maintaining a Mike deployment should borrow the replay-safety idea, but avoid these deletions until smtp explains or restores them.

So what Security-conscious legal teams should pay attention because the fork combines a sensible reliability improvement with changes that may reopen access-control risk.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

1 commit from smtp/mike-2, oldest first. Source extracted verbatim from the harvested git log.

SHA Subject Author Date
60ae8717 migration fixes Carl Ngwenya 2026-08-14 ↗ GitHub

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-993.md from inside the repo you want the changes in.

⬇ Download capture-thread-993.md