Does that mean they haven't had any exploitable bugs? That seems extremely unlikely for a program written in C with the complexity that being an email client requires.

All of the recent changelog entries which sound like possibly-security-relevant bugs have seven-digit numbers prefixed with "CID", whereas the other bugs have four-digit bug numbers corresponding to entries in their bugzilla.

After a few minutes of searching, I have failed to figure out what "CID" means, or indeed to find any reference to these numbers outside of claws commit messages and release announcements. In any case, from the types of bugs which have these numbers instead of bugzilla entries, it seems to be the designation they are using for security bugs.

The effect of failing to register CVEs and issue security advisories is that downstream distributors of claws (such as the Linux distributions which the project's website recommends installing it from) do not patch these issues.

For instance, claws is included in Debian stable and three currently-supported LTS releases of Ubuntu - which are places where users could be receiving security updates if the project registered CVEs, but are not since they don't.

Even if you get claws from a rolling release distro, or build the latest release yourself, it looks like you'd still be lagging substantially on likely-security-relevant updates: there have actually been numerous commits containing CID numbers in the month since the last release.

If the claws developers happen to read this: thanks for writing free software, but: please update your FAQ to explain these CID numbers, and start issuing security advisories and/or registering CVEs when appropriate so that your distributors will ship security updates to your users!