Production-ready fullstack but simple mail server (SMTP, IMAP, LDAP, Antispam, Antivirus, etc.) running inside a container.
This report summarizes scanner evidence for docker-mailserver/docker-mailserver, a Shell project with 19,252 GitHub stars. SynthScan examined 22,174 lines of code across 182 source files, recording 92 pattern matches distributed across 8 syntactic categories. The legacy adjusted pattern signal is 6.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 83 finding(s).
Are imports declared and package/API names verified? 3 finding(s).
Are wrappers, guards, and repeated structures necessary? 6 finding(s).
Which changes need focused human review? 92 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 92 distinct pattern matches across 8 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | compose.yaml | 21 | - /etc/localtime:/etc/localtime:ro | COMMENT |
| LOW | test/config/junk-mailbox/user-patches.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/config/dovecot-lmtp/user-patches.sh | 21 | # unix_listener lmtp { | COMMENT |
| LOW | test/config/user-patches/user-patches.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/config/rspamd_full/user-patches.sh | 1 | #!/bin/bash | COMMENT |
| LOW | test/helper/log_and_filtering.bash | 1 | #!/bin/bash | COMMENT |
| LOW | test/helper/change-detection.bash | 1 | #!/bin/bash | COMMENT |
| LOW | test/helper/common.bash | 1 | #!/bin/bash | COMMENT |
| LOW | test/helper/common.bash | 21 | load "${REPOSITORY_ROOT}/test/helper/log_and_filtering" | COMMENT |
| LOW | test/helper/common.bash | 41 | # If neither an explicit non-empty argument is given nor `CONTAINER_NAME` | COMMENT |
| LOW | test/helper/common.bash | 101 | # Execute a command inside the container with name ${CONTAINER_NAME}. The command | COMMENT |
| LOW | test/helper/common.bash | 121 | COMMENT | |
| LOW | test/helper/common.bash | 421 | [[ -v CONTAINER_NAME ]] || return 1 | COMMENT |
| LOW | test/helper/sending.bash | 1 | #!/bin/bash | COMMENT |
| LOW | test/helper/sending.bash | 21 | # The very first parameter **may** be `--expect-rejection` - use it of you expect the mail transaction to not finish | COMMENT |
| LOW | test/helper/sending.bash | 101 | echo "${output}" | COMMENT |
| LOW | test/helper/setup.bash | 1 | #!/bin/bash | COMMENT |
| LOW | test/helper/setup.bash | 41 | COMMENT | |
| LOW | test/helper/setup.bash | 81 | # - Use `local <VARIABLE>` to override within a specific test case. | COMMENT |
| LOW | test/helper/setup.bash | 101 | export TEST_FILES_VOLUME="${REPOSITORY_ROOT}/test/files:${TEST_FILES_CONTAINER_PATH}:ro" | COMMENT |
| LOW | test/helper/tls.bash | 1 | #!/bin/bash | COMMENT |
| LOW | config-examples/user-patches.sh | 1 | #!/bin/bash | COMMENT |
| LOW | target/scripts/check-for-changes.sh | 1 | #!/bin/bash | COMMENT |
| LOW | target/scripts/startup/variables-stack.sh | 41 | _log 'error' "'ENABLE_RSPAMD_REDIS' has been renamed to 'ENABLE_RSPAMD_VALKEY' since DMS v17" | COMMENT |
| LOW | target/scripts/startup/setup.d/dovecot.sh | 21 | # Dovecot 3.0 docs: | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 1 | #!/bin/bash | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 21 | # | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 41 | # There is a minor chance of a lookup occurring during a rebuild of these files that may affect or delay delivery? | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 101 | 'smtp_tls_security_level = encrypt' | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 201 | } | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 221 | # relay-service.test relay-account:relay-pass | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 241 | # setup /etc/postfix/relayhost_map | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 261 | # smtp_tls_security_level = encrypt | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 281 | COMMENT | |
| LOW | target/scripts/helpers/relay.sh | 301 | # https://www.mailjet.com/blog/news/which-smtp-port-mailjet/#port-465 | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 321 | # and incorrectly describe how they deliver mail: | COMMENT |
| LOW | target/scripts/helpers/relay.sh | 341 | # | COMMENT |
| LOW | target/scripts/helpers/utils.sh | 101 | COMMENT | |
| LOW | target/scripts/helpers/ssl.sh | 161 | # This same sequence is used for the Traefik `acme.json` certificate extraction process, which outputs the FQDN fo | COMMENT |
| LOW | target/scripts/helpers/ssl.sh | 321 | # smtpd_tls_security_level (default: 'may', port 587 'encrypt') | http://www.postfix.org/postconf.5.html#smtpd_tls | COMMENT |
| LOW | target/scripts/helpers/dns.sh | 1 | #!/bin/bash | COMMENT |
| LOW | target/scripts/helpers/dns.sh | 21 | # TODO: `OVERRIDE_HOSTNAME` was introduced for non-Docker runtimes that could not configure an explicit hostname. | COMMENT |
| LOW | target/scripts/helpers/dns.sh | 41 | # Emulates the intended behaviour of `hostname -d`: | COMMENT |
| LOW | target/scripts/helpers/accounts.sh | 81 | # Required when using Dovecot Quotas to avoid blacklisting risk from backscatter. | COMMENT |
| LOW | target/scripts/helpers/log.sh | 21 | LCYAN=$(echo -ne '\e[1;36m') | COMMENT |
| LOW | target/scripts/helpers/rspamd.sh | 81 | # | COMMENT |
| LOW | target/scripts/helpers/postfix.sh | 1 | #!/bin/bash | COMMENT |
| LOW | target/scripts/helpers/postfix.sh | 81 | [[ ${ACCOUNT_PROVISIONER} == 'LDAP' ]] && echo "${DOMAINNAME}" >>"${TMP_VHOST}" | COMMENT |
| LOW | …get/scripts/helpers/database/manage/postfix-virtual.sh | 1 | #!/bin/bash | COMMENT |
| LOW | docs/content/faq.md | 421 | Edit the system cron file `nano ./docker-data/dms/cron/sa-learn`, and set an appropriate configuration: | COMMENT |
| LOW | docs/content/config/advanced/full-text-search.md | 61 | # falls back to a slow non-indexed search. | COMMENT |
| LOW | …content/config/advanced/mail-forwarding/relay-hosts.md | 121 | ```cf-extra | COMMENT |
| LOW | …cs/content/examples/use-cases/ios-mail-push-support.md | 141 | # 2. You don't need your mailboxes to synchronize immediately since they are automatically synchronized when ope | COMMENT |
| LOW | .github/FUNDING.yml | 1 | github: [georglauterbach] | COMMENT |
| LOW | .github/workflows/docs-preview-deploy.yml | 101 | with: | COMMENT |
| LOW | .github/workflows/docs-preview-deploy.yml | 121 | # Disable adding a comment about successful deployment status to the PR. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/helper/common.bash | 16 | # This function is internal and should not be used in tests. | COMMENT |
| MEDIUM | test/helper/common.bash | 54 | # This function is internal and should not be used in tests. | COMMENT |
| MEDIUM | test/helper/setup.bash | 17 | # This function is internal and should not be used in tests. | COMMENT |
| MEDIUM | test/helper/setup.bash | 56 | # Create a dedicated configuration directory for a test file. | COMMENT |
| MEDIUM | target/scripts/startup/variables-stack.sh | 20 | # This function handles variables that are deprecated. This allows a | COMMENT |
| MEDIUM | target/scripts/startup/variables-stack.sh | 197 | # This function handles environment variables related to LDAP. | COMMENT |
| MEDIUM | target/scripts/startup/variables-stack.sh | 215 | # This function handles environment variables related to SASLAUTHD | COMMENT |
| MEDIUM | target/scripts/startup/setup.d/getmail.sh | 14 | # Create the directory /etc/getmailrc.d to place the user config in later. | COMMENT |
| MEDIUM | target/scripts/startup/setup.d/saslauthd.sh | 13 | # Create a config based on ENV | COMMENT |
| MEDIUM | target/scripts/startup/setup.d/fetchmail.sh | 71 | # Create a new fetchmail config for this poll entry: | COMMENT |
| MEDIUM | target/scripts/startup/setup.d/security/rspamd.sh | 3 | # This file is executed during startup of DMS. Hence, the `index.sh` helper has already | COMMENT |
| MEDIUM | target/scripts/startup/setup.d/security/rspamd.sh | 277 | # This function handles setup of the Hfilter module (see | COMMENT |
| MEDIUM | target/scripts/startup/setup.d/security/rspamd.sh | 303 | # This function handles setup of the neural module (see | COMMENT |
| MEDIUM | target/scripts/helpers/relay.sh | 125 | # Create the relayhost_map config file: | COMMENT |
| MEDIUM | target/scripts/helpers/log.sh | 29 | # This function provides the logging for scripts used by DMS. | COMMENT |
| MEDIUM | target/scripts/helpers/rspamd.sh | 20 | # Create a temporary log file (with `mktemp`) that one can filter to search | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | target/scripts/start-mailserver.sh | 10 | # ------------------------------------------------------------ | COMMENT |
| MEDIUM | target/scripts/start-mailserver.sh | 12 | # ------------------------------------------------------------ | COMMENT |
| MEDIUM | target/scripts/start-mailserver.sh | 29 | # ------------------------------------------------------------ | COMMENT |
| MEDIUM | target/scripts/start-mailserver.sh | 33 | # ------------------------------------------------------------ | COMMENT |
| MEDIUM | target/scripts/start-mailserver.sh | 163 | # ------------------------------------------------------------ | COMMENT |
| MEDIUM | target/scripts/start-mailserver.sh | 167 | # ------------------------------------------------------------ | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/helper/change-detection.bash | 80 | # Read file in reverse, collect lines until match with sed is found, | COMMENT |
| LOW | test/helper/common.bash | 383 | # Check if a container is running. | COMMENT |
| LOW | target/scripts/startup/setup.d/getmail.sh | 17 | # Check if custom getmailrc_general.cf file is present. | COMMENT |
| LOW | target/scripts/startup/setup.d/security/rspamd.sh | 286 | # Check if we received a number first | COMMENT |
| LOW | target/scripts/helpers/utils.sh | 153 | # Check if an environment variable's value is zero or one. This aids in checking variables | COMMENT |
| LOW | target/scripts/helpers/utils.sh | 176 | # Check if an environment variable's value is an integer. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | test/helper/common.bash | 27 | # test suite more robust as we can be sure that the container name is | COMMENT |
| MEDIUM | target/scripts/helpers/relay.sh | 117 | # By sender: `sender_dependent_default_transport_maps = texthash:/etc/postfix/sender_transport_map` (the current opt-o | COMMENT |
| MEDIUM | …et/scripts/helpers/database/manage/postfix-accounts.sh | 48 | # Dovecot Master account support can leverage the same management logic: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | test/files/emails/quota-exceeded.txt | 6 | Lorem ipsum dolor sit amet. Et quidem architecto id Quis saepe vel corporis odit aut nesciunt nisi. Et voluptatem exerci | CODE |
| LOW | test/files/emails/quota-exceeded.txt | 6 | Lorem ipsum dolor sit amet. Et quidem architecto id Quis saepe vel corporis odit aut nesciunt nisi. Et voluptatem exerci | CODE |
| LOW | docs/content/config/security/ssl.md | 453 | LETSENCRYPT_mail_EMAIL='admin@example.com' | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | config-examples/user-patches.sh | 6 | # If you modify any supervisord configuration, make sure to run | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | target/bin/acme_extract.py | 22 | CODE |