v0.2.0 — connect your own mailbox

First tagged release of CrawlProof. Headline change: outreach on /leads can now send from your own mailbox instead of the shared platform sender, so replies land in your inbox and deliverability follows your domain.

Mailbox autodiscovery

Enter an email address and CrawlProof works out the IMAP/SMTP settings from DNS — no hunting through your mail host's docs for a hostname and a port.

Discovery walks the most authoritative source first: SRV records (RFC 6186) → Thunderbird autoconfig → Outlook autodiscover → Mozilla ISPDB → an MX-to-provider map → a convention guess that is clearly labelled as a guess.

Verified against Forward Email, Gmail, and Fastmail.

Forward Email note: hosts that have you CNAME autoconfig.<domain> at them serve a certificate covering only their own names, so fetching the vanity hostname fails TLS. CrawlProof resolves the CNAME and re-asks the provider under a name its certificate actually covers, rather than skipping verification.

Confirm before you type a password

Discovery shows what it found and where it came from, with every field editable, and only then asks for a password. The login is verified before anything is saved — nothing is stored if the check fails.

Credentials at rest

Mailbox passwords are encrypted with AES-256-GCM. The key lives in the application environment and never in the database, so a database dump yields ciphertext and no key. This protects against database compromise, not application-server compromise.

Operators: SOCIAL_VAULT_KEY now guards mailbox credentials as well as social tokens. Rotating it invalidates stored mailbox passwords and requires reconnecting.

Upgrade notes

Migration 20260727120000_outreach_mailbox_imap.sql adds columns to organization_outreach_configs. Additive only, and it must be applied before deploying this version.