From 853cb5d052bbf197fe0383246269d7ceba2165a6 Mon Sep 17 00:00:00 2001
From: Linus Rath <139418639+rathlinus@users.noreply.github.com>
Date: Sat, 31 Oct 2026 03:53:25 +0100
Subject: [PATCH] docs: note that stalwart 1.0.1 keeps drafts and sent mail
 unencrypted at rest

---
 src/api/account-security.ts | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/src/api/account-security.ts b/src/api/account-security.ts
index 0f7a4cb0..20d6b9d2 100644
--- a/src/api/account-security.ts
+++ b/src/api/account-security.ts
@@ -250,8 +250,11 @@ export async function fetchCryptoInfo(): Promise<CryptoInfo> {
  * Configure Stalwart's encryption at rest (`x:AccountSettings/set`
  * `encryptionAtRest`). `Aes128`/`Aes256` need a public key id from
  * {@link fetchPublicKeys}; `encryptOnAppend` also encrypts mail the user
- * files (sent/imported), `allowSpamTraining` lets the classifier read a
- * message before it is encrypted.
+ * files (imported or appended over IMAP), `allowSpamTraining` lets the
+ * classifier read a message before it is encrypted. Since Stalwart 1.0.1
+ * JMAP drafts (`$draft`) and the Sent copy of a JMAP submission are stored
+ * unencrypted, so they stay editable and go out readable; 0.16 and 1.0.0
+ * encrypted those too.
  */
 export async function updateEncryptionAtRest(input: {
   type: EncryptionType;