Skip to content
- A single administrator: one shared password, no accounts or roles.
- SQLite (WAL) on the
./data volume: a single host, no high availability. Web and worker
share the same file, which must stay on a local disk (no NFS).
- PST fingerprint tied to
UPLOAD_CHUNK_SIZE: changing this value after a first import
loses recognition of the same file (see Pause, resume and retry), with a risk
of duplicates if the PST is re-uploaded.
- libpff: a corrupted PST can crash the native library. The affected items are
skipped (“libpff crash” error); beyond
MAX_CHILD_CRASHES crashes, the job fails. The counter
is per job and reset at the end of the job. A badly damaged PST can be rejected at analysis.
- Encrypted / password-protected PSTs: no dedicated handling in the code; a PST whose
content is encrypted will give errors or be
invalid. Do not rely on it.
- Depends on the quality of the target server: APPEND, SPECIAL-USE, quota (
GETQUOTAROOT if available)
and DAV discovery vary between servers.
- No Swagger UI:
/docs, /redoc and /openapi.json are disabled (the API reference
is in API).
- In-memory login rate limiting: 5 failures / 5 min per IP, reset when
web restarts.
Behind a proxy, check that X-Forwarded-For is forwarded, otherwise all requests
share the proxy’s IP.
- Mailbox passwords are stored encrypted but can be decrypted by the application: protect
./data and the SECRET_KEY.
- Browser support. JS libs are vendored (works offline), but the
browser must support modern APIs (fetch, SSE,
File.slice).
