Sign-in code mail through the customer's relay

The vault sends one-time sign-in codes through the customer's OWN mail

relay — one of its two disclosed outbound connections, and content-free

by construction: the message carries the code and nothing else. The

relay is optional configuration an administrator provides at initial

setup (or later, through the admin console, with no restart): host,

port, From address, transport security, and optional credentials.

Optional means optional, and it means it in both directions. A sign-in

that needs no code does not touch the relay at all — the decision is made

before any delivery is attempted — so a vault with no relay configured

can still be signed into. A sign-in that DOES need a code, and has no way

to deliver one, is refused honestly rather than pretending a code was

sent. The relay password is a secret the vault never writes into a URL or

an audit entry.

Given a vault with no mail relay configured
When a person tries to begin signing in
Then the vault refuses honestly that code delivery is unavailable

A half-configured relay refuses rather than guessing

Given a vault whose relay is enabled but missing its host
When a person tries to begin signing in
Then the vault refuses honestly that code delivery is unavailable

A configured relay delivers the code and nothing else

Given a vault whose administrator configured an SMTP relay
When the vault sends a sign-in code
Then the relay receives one message carrying exactly the code

The relay upgrades to TLS before anything else by default

Given a vault whose administrator configured an SMTP relay
When the vault sends a sign-in code
Then the connection is secured before the message travels

The relay password never travels in a URL or an audit entry

Given a vault whose administrator configured an SMTP relay with credentials
When the administrator's configuration change is audited
Then the audit entry records the password only as redacted
And no route in the vault accepts the relay credentials in a URL

The deployed vault surfaces the refusal at its front doorstack

Given the deployed vault with its mail relay cleared by the console
When a member with the right password tries to sign in at the front door
Then the vault refuses honestly that code delivery is unavailable

A wrong password on the same vault is told nothing about the relaystack

Given the deployed vault with its mail relay cleared by the console
When someone with the wrong password tries to sign in at the front door
Then the vault says only that the credentials were bad