Kind reminder to make sure your mail server is secure. Also use 2FA.

A befriended company hosted their own mail server to send transactional mails of their self-hosted tools.

That server got hacked, attackers were able to intercept reset password emails, got access to code repositories and were able to ship malicious code through the fully automated CI/CD pipelines.