Security comes from several narrow boundaries
RelayBridge does not rely on one control or claim that every risk is eliminated. RC1 combines a loopback management boundary, one explicit private SMTP listener, per-device authorization, durable local storage, certificate-based Microsoft identity, sender-scoped Exchange RBAC, and certificate-validated outbound TLS.
| Boundary | Implemented control | Administrator responsibility or residual risk |
|---|---|---|
| Management | Fixed HTTP loopback binding; no remote management; opener accepts no arbitrary URL | Protect the Windows session and local Administrator access |
| Device LAN | One explicit private listener; no wildcard or public binding; source and sender allowlists | Isolate the LAN, restrict firewall scope, and accept that inbound TLS is absent |
| Authenticated devices | One-time generated secret, salted verifier, and bounded authentication attempts | Protect the displayed password and device configuration; credentials cross the private LAN in cleartext |
| Legacy devices | No password, but public and unrestricted source rules are rejected | Reserve stable private addresses and prevent spoofing or untrusted LAN access |
| Queue | Streamed spool, durable flush, atomic promotion, and SQLite commit before local 250 | Protect ProgramData, monitor capacity, and plan backup and retention |
| Microsoft identity | Customer-owned single-tenant app and non-exportable local certificate; no client secret | Monitor certificate lifecycle and tenant-side changes |
| Exchange authorization | Sender group, management scope, and scoped Application SMTP.SendAsApp | Keep the selected mailbox and RBAC objects under change control |
| Outbound SMTP | Fixed Exchange endpoint, mandatory STARTTLS, platform certificate validation, and XOAUTH2 | Permit the required network path without bypassing TLS checks |
| Privileged operations | Short-lived fixed helpers, bounded one-shot state, and narrow allowlisted operations | Review each elevation prompt and recognize that a local Administrator can change installed state |
| Diagnostics/export | Bounded status schemas and a local allowlisted support bundle | Review operational metadata before sharing |
| Servicing | Per-machine WiX/MSI service, ACL, repair, upgrade, and uninstall behavior | Deliberately retain or remove ProgramData, certificates, and tenant objects |
Management and privileged actions
Management is code-bound to loopback. The installed endpoint is normally http://localhost:5080/, and effective non-loopback overrides fail startup. There is no RC1 remote-management feature.
The LocalSystem Windows service and the signed-in user's browser remain separate. The desktop opener reads a protected machine registry value, validates an HTTP loopback root endpoint, waits for /health, and opens the dashboard or Microsoft setup without elevation.
Microsoft administration and printer Apply use fixed installed helpers with process, session, path, hash, and candidate checks. These controls reduce exposed functionality; they do not make a local Administrator untrusted.
Mail and identity boundaries
Device-to-RelayBridge SMTP is cleartext on one trusted private interface. Authenticated mode adds a device-specific credential, but that credential also crosses the private LAN without TLS. Legacy mode has no credential and therefore requires stricter private source isolation.
RelayBridge-to-Exchange Online is a different connection. It requires normal certificate-validated STARTTLS on TCP 587 and XOAUTH2 using the customer-owned application and local certificate.
Message content remains in the protected local spool while queued. An ambiguous upstream response can cause a retry and duplicate. A final Exchange 250 is acceptance by Microsoft at the SMTP boundary, not proof of inbox placement.
RC1 limitations
- Unsigned pre-release: Windows may show Unknown Publisher and SmartScreen may warn. RC1 is for evaluation and community testing, not the signed stable production release.
- Windows client scope: Windows 10/11 x64 with one locally interactive administrator is supported. Windows Server, Server Core, RDP native setup, simultaneous setup users, x86, and Arm64 are not claimed.
- No inbound STARTTLS: device SMTP, including reusable AUTH credentials, is cleartext on the trusted private LAN.
- Manual firewall boundary: RelayBridge generates guidance but does not create or modify Windows Firewall rules.
- One tenant, application, and sender: RC1 does not provide multi-tenant or multiple authorized-sender configuration.
- Variable Exchange propagation: Step 5 checks are bounded; no duration is guaranteed and not every SMTP 535 is propagation.
- No remote management: the management UI remains on local loopback.
- No automatic updater: release checking is manual and informational; there is no automatic check, download, or installation.
- No Graph delivery fallback: Exchange Online SMTP AUTH with OAuth/XOAUTH2 is the production delivery path.
- At-least-once delivery: an ambiguous upstream failure can result in a retry and possible duplicate.
- Acceptance is not inbox placement: Exchange
250does not guarantee final delivery. - No automatic cleanup: uninstall preserves ProgramData and does not remove certificates, private keys, or Microsoft tenant objects.
- No signed stable build: a signed stable RelayBridge v1.0.0 is not available.
Security reporting
Use the application's private vulnerability-reporting process described in SECURITY.md. Do not publish suspected vulnerabilities or include tenant identifiers, mailbox or message data, credentials, tokens, certificates, private keys, raw configuration, databases, spool files, or unreviewed support bundles in a public issue.