Pigeonhole's file storage followed any symlink encountered while resolving a script path, including symlinks in personal (user-writable) storage whose target lay outside the storage directory. In some non-recommended configurations a user could exploit this through the include extension: an "include :personal name;" lookup of ~/sieve/name.sieve transparently followed a user-placed to e.g. another user's file readable by the mail process, leaking its contents (or causing it to be parsed as Sieve). Normally this shouldn't be possible, because sieve processes shouldn't have any more privileges to read files than the local system user creating the symlink.