···136136spam = "~/.config/neomd/lists/spam.txt"
137137```
138138139139-Use an app-specific password (Gmail, Fastmail, Hostpoint, etc.) rather than your main account password.
139139+Use an app-specific password (Gmail, Fastmail, Hostpoint, etc.) rather than your main account password. The `password` and `user` fields support environment variable expansion (`$VAR` or `${VAR}`) so you can avoid storing secrets in the config file.
140140141141For the full configuration reference including multiple accounts, OAuth2 authentication, `[[senders]]` aliases, folder customization, signatures, and UI options, see [docs/configuration.md](docs/configuration.md).
142142
+11
docs/configuration.md
···77777878Use an app-specific password (Gmail, Fastmail, Hostpoint, etc.) rather than your main account password.
79798080+### Environment Variables
8181+8282+The `password` and `user` fields support environment variable expansion. If the entire value is a single env var reference, neomd resolves it at startup:
8383+8484+```toml
8585+password = "$IMAP_PASS" # $VAR form
8686+password = "${IMAP_PASS}" # ${VAR} form
8787+```
8888+8989+Values containing other text or multiple `$` signs are left as-is, so passwords that happen to contain `$` are never mangled.
9090+8091Credentials are stored only in `~/.config/neomd/config.toml` (mode 0600) and never written elsewhere; all IMAP connections use TLS (port 993) or STARTTLS (port 143).
81928293## Sending and Discarding