From: Richard Russon <rich@flatcap.org>
Date: Mon, 25 Feb 2019 22:17:44 +0000 (+0000)
Subject: add a 'SEC_' prefix to the security flags
X-Git-Tag: 2019-10-25~354^2~5
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c3ccfce8dc9cb23ff935107593845f73e12f0907;p=neomutt

add a 'SEC_' prefix to the security flags

Symbols like 'SIGN' and 'INLINE' are hard to search for.
---

diff --git a/commands.c b/commands.c
index becff2d93..a95bd78d4 100644
--- a/commands.c
+++ b/commands.c
@@ -103,7 +103,7 @@ static void update_protected_headers(struct Email *cur)
     return;
 
   /* Grab protected headers to update in the index */
-  if (cur->security & SIGN)
+  if (cur->security & SEC_SIGN)
   {
     /* Don't update on a bad signature.
      *
@@ -111,7 +111,7 @@ static void update_protected_headers(struct Email *cur)
      * encrypted part of a nested encrypt/signed.  But properly handling that
      * case would require more complexity in the decryption handlers, which
      * I'm not sure is worth it. */
-    if (!(cur->security & GOODSIGN))
+    if (!(cur->security & SEC_GOODSIGN))
       return;
 
     if (mutt_is_multipart_signed(cur->content) && cur->content->parts)
@@ -123,7 +123,7 @@ static void update_protected_headers(struct Email *cur)
       prot_headers = cur->content->mime_headers;
     }
   }
-  if (!prot_headers && (cur->security & ENCRYPT))
+  if (!prot_headers && (cur->security & SEC_ENCRYPT))
   {
     if ((WithCrypto & APPLICATION_PGP) &&
         (mutt_is_valid_multipart_pgp_encrypted(cur->content) ||
@@ -192,7 +192,7 @@ int mutt_display_message(struct Email *cur)
   /* see if crypto is needed for this message.  if so, we should exit curses */
   if ((WithCrypto != 0) && cur->security)
   {
-    if (cur->security & ENCRYPT)
+    if (cur->security & SEC_ENCRYPT)
     {
       if (cur->security & APPLICATION_SMIME)
         crypt_smime_getkeys(cur->env);
@@ -201,7 +201,7 @@ int mutt_display_message(struct Email *cur)
 
       cmflags |= MUTT_CM_VERIFY;
     }
-    else if (cur->security & SIGN)
+    else if (cur->security & SEC_SIGN)
     {
       /* find out whether or not the verify signature */
       /* L10N: Used for the $crypt_verify_sig prompt */
@@ -212,7 +212,7 @@ int mutt_display_message(struct Email *cur)
     }
   }
 
-  if (cmflags & MUTT_CM_VERIFY || cur->security & ENCRYPT)
+  if (cmflags & MUTT_CM_VERIFY || cur->security & SEC_ENCRYPT)
   {
     if (cur->security & APPLICATION_PGP)
     {
@@ -291,7 +291,7 @@ int mutt_display_message(struct Email *cur)
   if (WithCrypto)
   {
     /* update crypto information for this message */
-    cur->security &= ~(GOODSIGN | BADSIGN);
+    cur->security &= ~(SEC_GOODSIGN | SEC_BADSIGN);
     cur->security |= crypt_query(cur->content);
 
     /* Remove color cache for this message, in case there
@@ -306,26 +306,26 @@ int mutt_display_message(struct Email *cur)
   {
     if ((WithCrypto != 0) && (cur->security & APPLICATION_SMIME) && (cmflags & MUTT_CM_VERIFY))
     {
-      if (cur->security & GOODSIGN)
+      if (cur->security & SEC_GOODSIGN)
       {
         if (crypt_smime_verify_sender(cur) == 0)
           mutt_message(_("S/MIME signature successfully verified"));
         else
           mutt_error(_("S/MIME certificate owner does not match sender"));
       }
-      else if (cur->security & PARTSIGN)
+      else if (cur->security & SEC_PARTSIGN)
         mutt_message(_("Warning: Part of this message has not been signed"));
-      else if (cur->security & SIGN || cur->security & BADSIGN)
+      else if (cur->security & SEC_SIGN || cur->security & SEC_BADSIGN)
         mutt_error(_("S/MIME signature could NOT be verified"));
     }
 
     if ((WithCrypto != 0) && (cur->security & APPLICATION_PGP) && (cmflags & MUTT_CM_VERIFY))
     {
-      if (cur->security & GOODSIGN)
+      if (cur->security & SEC_GOODSIGN)
         mutt_message(_("PGP signature successfully verified"));
-      else if (cur->security & PARTSIGN)
+      else if (cur->security & SEC_PARTSIGN)
         mutt_message(_("Warning: Part of this message has not been signed"));
-      else if (cur->security & SIGN)
+      else if (cur->security & SEC_SIGN)
         mutt_message(_("PGP signature could NOT be verified"));
     }
 
@@ -506,7 +506,7 @@ static void pipe_msg(struct Mailbox *m, struct Email *e, FILE *fp, bool decode,
 
   pipe_set_flags(decode, print, &cmflags, &chflags);
 
-  if ((WithCrypto != 0) && decode && e->security & ENCRYPT)
+  if ((WithCrypto != 0) && decode && e->security & SEC_ENCRYPT)
   {
     if (!crypt_valid_passphrase(e->security))
       return;
@@ -555,7 +555,8 @@ static int pipe_message(struct Mailbox *m, struct EmailList *el, char *cmd,
     if ((WithCrypto != 0) && decode)
     {
       mutt_parse_mime_message(m, en->email);
-      if ((en->email->security & ENCRYPT) && !crypt_valid_passphrase(en->email->security))
+      if ((en->email->security & SEC_ENCRYPT) &&
+          !crypt_valid_passphrase(en->email->security))
         return 1;
     }
     mutt_endwin();
@@ -582,7 +583,8 @@ static int pipe_message(struct Mailbox *m, struct EmailList *el, char *cmd,
       {
         mutt_message_hook(m, en->email, MUTT_MESSAGE_HOOK);
         mutt_parse_mime_message(m, en->email);
-        if ((en->email->security & ENCRYPT) && !crypt_valid_passphrase(en->email->security))
+        if ((en->email->security & SEC_ENCRYPT) &&
+            !crypt_valid_passphrase(en->email->security))
         {
           return 1;
         }
@@ -887,7 +889,7 @@ static void set_copy_flags(struct Email *e, bool decode, bool decrypt,
   *cmflags = 0;
   *chflags = CH_UPDATE_LEN;
 
-  if ((WithCrypto != 0) && !decode && decrypt && (e->security & ENCRYPT))
+  if ((WithCrypto != 0) && !decode && decrypt && (e->security & SEC_ENCRYPT))
   {
     if (((WithCrypto & APPLICATION_PGP) != 0) && mutt_is_multipart_encrypted(e->content))
     {
@@ -895,12 +897,12 @@ static void set_copy_flags(struct Email *e, bool decode, bool decrypt,
       *cmflags = MUTT_CM_DECODE_PGP;
     }
     else if (((WithCrypto & APPLICATION_PGP) != 0) &&
-             mutt_is_application_pgp(e->content) & ENCRYPT)
+             mutt_is_application_pgp(e->content) & SEC_ENCRYPT)
     {
       decode = 1;
     }
     else if (((WithCrypto & APPLICATION_SMIME) != 0) &&
-             mutt_is_application_smime(e->content) & ENCRYPT)
+             mutt_is_application_smime(e->content) & SEC_ENCRYPT)
     {
       *chflags = CH_NONEWLINE | CH_XMIT | CH_MIME;
       *cmflags = MUTT_CM_DECODE_SMIME;
@@ -1007,7 +1009,7 @@ int mutt_save_message(struct Mailbox *m, struct EmailList *el, bool delete,
 
   if (WithCrypto)
   {
-    need_passphrase = (en->email->security & ENCRYPT);
+    need_passphrase = (en->email->security & SEC_ENCRYPT);
     app = en->email->security;
   }
   mutt_message_hook(m, en->email, MUTT_MESSAGE_HOOK);
diff --git a/compose.c b/compose.c
index 0251ae890..32a516eaa 100644
--- a/compose.c
+++ b/compose.c
@@ -280,17 +280,17 @@ static void redraw_crypt_lines(struct Email *msg)
     return;
   }
 
-  if ((msg->security & (ENCRYPT | SIGN)) == (ENCRYPT | SIGN))
+  if ((msg->security & (SEC_ENCRYPT | SEC_SIGN)) == (SEC_ENCRYPT | SEC_SIGN))
   {
     SETCOLOR(MT_COLOR_COMPOSE_SECURITY_BOTH);
     addstr(_("Sign, Encrypt"));
   }
-  else if (msg->security & ENCRYPT)
+  else if (msg->security & SEC_ENCRYPT)
   {
     SETCOLOR(MT_COLOR_COMPOSE_SECURITY_ENCRYPT);
     addstr(_("Encrypt"));
   }
-  else if (msg->security & SIGN)
+  else if (msg->security & SEC_SIGN)
   {
     SETCOLOR(MT_COLOR_COMPOSE_SECURITY_SIGN);
     addstr(_("Sign"));
@@ -303,11 +303,11 @@ static void redraw_crypt_lines(struct Email *msg)
   }
   NORMAL_COLOR;
 
-  if ((msg->security & (ENCRYPT | SIGN)))
+  if ((msg->security & (SEC_ENCRYPT | SEC_SIGN)))
   {
     if (((WithCrypto & APPLICATION_PGP) != 0) && (msg->security & APPLICATION_PGP))
     {
-      if ((msg->security & INLINE))
+      if ((msg->security & SEC_INLINE))
         addstr(_(" (inline PGP)"));
       else
         addstr(_(" (PGP/MIME)"));
@@ -316,7 +316,7 @@ static void redraw_crypt_lines(struct Email *msg)
       addstr(_(" (S/MIME)"));
   }
 
-  if (CryptOpportunisticEncrypt && (msg->security & OPPENCRYPT))
+  if (CryptOpportunisticEncrypt && (msg->security & SEC_OPPENCRYPT))
     addstr(_(" (OppEnc mode)"));
 
   mutt_window_clrtoeol(MuttIndexWindow);
@@ -324,7 +324,7 @@ static void redraw_crypt_lines(struct Email *msg)
   mutt_window_clrtoeol(MuttIndexWindow);
 
   if (((WithCrypto & APPLICATION_PGP) != 0) &&
-      (msg->security & APPLICATION_PGP) && (msg->security & SIGN))
+      (msg->security & APPLICATION_PGP) && (msg->security & SEC_SIGN))
   {
     SETCOLOR(MT_COLOR_COMPOSE_HEADER);
     printw("%*s", HeaderPadding[HDR_CRYPTINFO], _(Prompts[HDR_CRYPTINFO]));
@@ -333,7 +333,7 @@ static void redraw_crypt_lines(struct Email *msg)
   }
 
   if (((WithCrypto & APPLICATION_SMIME) != 0) &&
-      (msg->security & APPLICATION_SMIME) && (msg->security & SIGN))
+      (msg->security & APPLICATION_SMIME) && (msg->security & SEC_SIGN))
   {
     SETCOLOR(MT_COLOR_COMPOSE_HEADER);
     printw("%*s", HeaderPadding[HDR_CRYPTINFO], _(Prompts[HDR_CRYPTINFO]));
@@ -342,7 +342,7 @@ static void redraw_crypt_lines(struct Email *msg)
   }
 
   if (((WithCrypto & APPLICATION_SMIME) != 0) && (msg->security & APPLICATION_SMIME) &&
-      (msg->security & ENCRYPT) && SmimeEncryptWith && *SmimeEncryptWith)
+      (msg->security & SEC_ENCRYPT) && SmimeEncryptWith && *SmimeEncryptWith)
   {
     SETCOLOR(MT_COLOR_COMPOSE_HEADER);
     mutt_window_mvprintw(MuttIndexWindow, HDR_CRYPTINFO, 40, "%s", _("Encrypt with: "));
@@ -1943,7 +1943,7 @@ int mutt_compose_menu(struct Email *msg, char *fcc, size_t fcclen, struct Email
         }
         if (((WithCrypto & APPLICATION_SMIME) != 0) && (msg->security & APPLICATION_SMIME))
         {
-          if (msg->security & (ENCRYPT | SIGN))
+          if (msg->security & (SEC_ENCRYPT | SEC_SIGN))
           {
             if (mutt_yesorno(_("S/MIME already selected. Clear and continue? "),
                              MUTT_YES) != MUTT_YES)
@@ -1951,7 +1951,7 @@ int mutt_compose_menu(struct Email *msg, char *fcc, size_t fcclen, struct Email
               mutt_clear_error();
               break;
             }
-            msg->security &= ~(ENCRYPT | SIGN);
+            msg->security &= ~(SEC_ENCRYPT | SEC_SIGN);
           }
           msg->security &= ~APPLICATION_SMIME;
           msg->security |= APPLICATION_PGP;
@@ -1978,14 +1978,14 @@ int mutt_compose_menu(struct Email *msg, char *fcc, size_t fcclen, struct Email
 
         if (((WithCrypto & APPLICATION_PGP) != 0) && (msg->security & APPLICATION_PGP))
         {
-          if (msg->security & (ENCRYPT | SIGN))
+          if (msg->security & (SEC_ENCRYPT | SEC_SIGN))
           {
             if (mutt_yesorno(_("PGP already selected. Clear and continue? "), MUTT_YES) != MUTT_YES)
             {
               mutt_clear_error();
               break;
             }
-            msg->security &= ~(ENCRYPT | SIGN);
+            msg->security &= ~(SEC_ENCRYPT | SEC_SIGN);
           }
           msg->security &= ~APPLICATION_PGP;
           msg->security |= APPLICATION_SMIME;
diff --git a/copy.c b/copy.c
index a3fa8ceac..74709eaa3 100644
--- a/copy.c
+++ b/copy.c
@@ -707,7 +707,7 @@ int mutt_copy_message_fp(FILE *fpout, FILE *fpin, struct Email *e, int flags, in
 
     rc = mutt_body_handler(body, &s);
   }
-  else if ((WithCrypto != 0) && (flags & MUTT_CM_DECODE_CRYPT) && (e->security & ENCRYPT))
+  else if ((WithCrypto != 0) && (flags & MUTT_CM_DECODE_CRYPT) && (e->security & SEC_ENCRYPT))
   {
     struct Body *cur = NULL;
     FILE *fp = NULL;
diff --git a/hdrline.c b/hdrline.c
index 76f9945e8..0c26e5daa 100644
--- a/hdrline.c
+++ b/hdrline.c
@@ -1330,11 +1330,11 @@ static const char *index_format_str(char *buf, size_t buflen, size_t col, int co
       else if (src[0] == 'c') /* crypto */
       {
         const char *ch = NULL;
-        if ((WithCrypto != 0) && (e->security & GOODSIGN))
+        if ((WithCrypto != 0) && (e->security & SEC_GOODSIGN))
           ch = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_GOOD_SIGN);
-        else if ((WithCrypto != 0) && (e->security & ENCRYPT))
+        else if ((WithCrypto != 0) && (e->security & SEC_ENCRYPT))
           ch = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_ENCRYPTED);
-        else if ((WithCrypto != 0) && (e->security & SIGN))
+        else if ((WithCrypto != 0) && (e->security & SEC_SIGN))
           ch = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_SIGNED);
         else if (((WithCrypto & APPLICATION_PGP) != 0) && ((e->security & PGP_KEY) == PGP_KEY))
         {
@@ -1396,11 +1396,11 @@ static const char *index_format_str(char *buf, size_t buflen, size_t col, int co
         second = get_nth_wchar(FlagChars, FLAG_CHAR_DELETED);
       else if (e->attach_del)
         second = get_nth_wchar(FlagChars, FLAG_CHAR_DELETED_ATTACH);
-      else if ((WithCrypto != 0) && (e->security & GOODSIGN))
+      else if ((WithCrypto != 0) && (e->security & SEC_GOODSIGN))
         second = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_GOOD_SIGN);
-      else if ((WithCrypto != 0) && (e->security & ENCRYPT))
+      else if ((WithCrypto != 0) && (e->security & SEC_ENCRYPT))
         second = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_ENCRYPTED);
-      else if ((WithCrypto != 0) && (e->security & SIGN))
+      else if ((WithCrypto != 0) && (e->security & SEC_SIGN))
         second = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_SIGNED);
       else if (((WithCrypto & APPLICATION_PGP) != 0) && (e->security & PGP_KEY))
         second = get_nth_wchar(CryptChars, FLAG_CHAR_CRYPT_CONTAINS_KEY);
diff --git a/mutt_attach.c b/mutt_attach.c
index cd4dc9b8c..96db8b74a 100644
--- a/mutt_attach.c
+++ b/mutt_attach.c
@@ -396,7 +396,7 @@ int mutt_view_attachment(FILE *fp, struct Body *a, int flag, struct Email *e,
 
   bool is_message = mutt_is_message_type(a->type, a->subtype);
   if ((WithCrypto != 0) && is_message && a->email &&
-      (a->email->security & ENCRYPT) && !crypt_valid_passphrase(a->email->security))
+      (a->email->security & SEC_ENCRYPT) && !crypt_valid_passphrase(a->email->security))
   {
     return rc;
   }
diff --git a/ncrypt/crypt.c b/ncrypt/crypt.c
index 6c27d7da2..6f170b7b4 100644
--- a/ncrypt/crypt.c
+++ b/ncrypt/crypt.c
@@ -176,10 +176,10 @@ int mutt_protect(struct Email *msg, char *keylist)
   if (!WithCrypto)
     return -1;
 
-  if (!(msg->security & (ENCRYPT | SIGN)))
+  if (!(msg->security & (SEC_ENCRYPT | SEC_SIGN)))
     return 0;
 
-  if ((msg->security & SIGN) && !crypt_valid_passphrase(msg->security))
+  if ((msg->security & SEC_SIGN) && !crypt_valid_passphrase(msg->security))
     return -1;
 
   if (((WithCrypto & APPLICATION_PGP) != 0) && ((msg->security & PGP_INLINE) == PGP_INLINE))
@@ -243,7 +243,7 @@ int mutt_protect(struct Email *msg, char *keylist)
   if (WithCrypto & APPLICATION_PGP)
     tmp_pgp_pbody = msg->content;
 
-  if (CryptUsePka && (msg->security & SIGN))
+  if (CryptUsePka && (msg->security & SEC_SIGN))
   {
     /* Set sender (necessary for e.g. PKA).  */
     const char *mailbox = NULL;
@@ -277,7 +277,7 @@ int mutt_protect(struct Email *msg, char *keylist)
     msg->content->mime_headers = protected_headers;
   }
 
-  if (msg->security & SIGN)
+  if (msg->security & SEC_SIGN)
   {
     if (((WithCrypto & APPLICATION_SMIME) != 0) && (msg->security & APPLICATION_SMIME))
     {
@@ -289,13 +289,13 @@ int mutt_protect(struct Email *msg, char *keylist)
     }
 
     if (((WithCrypto & APPLICATION_PGP) != 0) && (msg->security & APPLICATION_PGP) &&
-        (!(flags & ENCRYPT) || PgpRetainableSigs))
+        (!(flags & SEC_ENCRYPT) || PgpRetainableSigs))
     {
       tmp_pbody = crypt_pgp_sign_message(msg->content);
       if (!tmp_pbody)
         goto bail;
 
-      flags &= ~SIGN;
+      flags &= ~SEC_SIGN;
       pbody = tmp_pbody;
       tmp_pgp_pbody = tmp_pbody;
     }
@@ -307,7 +307,7 @@ int mutt_protect(struct Email *msg, char *keylist)
     }
   }
 
-  if (msg->security & ENCRYPT)
+  if (msg->security & SEC_ENCRYPT)
   {
     if (((WithCrypto & APPLICATION_SMIME) != 0) && (msg->security & APPLICATION_SMIME))
     {
@@ -331,7 +331,7 @@ int mutt_protect(struct Email *msg, char *keylist)
 
     if (((WithCrypto & APPLICATION_PGP) != 0) && (msg->security & APPLICATION_PGP))
     {
-      pbody = crypt_pgp_encrypt_message(tmp_pgp_pbody, keylist, (flags & SIGN));
+      pbody = crypt_pgp_encrypt_message(tmp_pgp_pbody, keylist, (flags & SEC_SIGN));
       if (!pbody)
       {
         /* did we perform a retainable signature? */
@@ -390,7 +390,7 @@ int mutt_is_multipart_signed(struct Body *b)
     return 0;
 
   if (!(mutt_str_strcasecmp(p, "multipart/mixed") != 0))
-    return SIGN;
+    return SEC_SIGN;
 
   if (((WithCrypto & APPLICATION_PGP) != 0) &&
       !(mutt_str_strcasecmp(p, "application/pgp-signature") != 0))
@@ -657,7 +657,7 @@ int mutt_is_application_smime(struct Body *m)
 /**
  * crypt_query - Check out the type of encryption used
  * @param m Body of email
- * @retval num Flags, e.g. #GOODSIGN
+ * @retval num Flags, e.g. #SEC_GOODSIGN
  * @retval 0   Error
  *
  * Set the cached status values if there are any.
@@ -681,16 +681,16 @@ int crypt_query(struct Body *m)
     {
       t |= mutt_is_application_smime(m);
       if (t && m->goodsig)
-        t |= GOODSIGN;
+        t |= SEC_GOODSIGN;
       if (t && m->badsig)
-        t |= BADSIGN;
+        t |= SEC_BADSIGN;
     }
   }
   else if (((WithCrypto & APPLICATION_PGP) != 0) && m->type == TYPE_TEXT)
   {
     t |= mutt_is_application_pgp(m);
     if (t && m->goodsig)
-      t |= GOODSIGN;
+      t |= SEC_GOODSIGN;
   }
 
   if (m->type == TYPE_MULTIPART)
@@ -700,7 +700,7 @@ int crypt_query(struct Body *m)
     t |= mutt_is_malformed_multipart_pgp_encrypted(m);
 
     if (t && m->goodsig)
-      t |= GOODSIGN;
+      t |= SEC_GOODSIGN;
   }
 
   if (m->type == TYPE_MULTIPART || m->type == TYPE_MESSAGE)
@@ -714,10 +714,10 @@ int crypt_query(struct Body *m)
       u &= v;
       w |= v;
     }
-    t |= u | (w & ~GOODSIGN);
+    t |= u | (w & ~SEC_GOODSIGN);
 
-    if ((w & GOODSIGN) && !(u & GOODSIGN))
-      t |= PARTSIGN;
+    if ((w & SEC_GOODSIGN) && !(u & SEC_GOODSIGN))
+      t |= SEC_PARTSIGN;
   }
 
   return t;
@@ -849,7 +849,7 @@ void crypt_extract_keys_from_messages(struct EmailList *el)
     struct Email *e = en->email;
 
     mutt_parse_mime_message(Context->mailbox, e);
-    if (e->security & ENCRYPT && !crypt_valid_passphrase(e->security))
+    if (e->security & SEC_ENCRYPT && !crypt_valid_passphrase(e->security))
     {
       mutt_file_fclose(&fpout);
       break;
@@ -868,7 +868,7 @@ void crypt_extract_keys_from_messages(struct EmailList *el)
 
     if (((WithCrypto & APPLICATION_SMIME) != 0) && (e->security & APPLICATION_SMIME))
     {
-      if (e->security & ENCRYPT)
+      if (e->security & SEC_ENCRYPT)
       {
         mutt_copy_message_ctx(fpout, Context->mailbox, e,
                               MUTT_CM_NOHEADER | MUTT_CM_DECODE_CRYPT | MUTT_CM_DECODE_SMIME,
@@ -945,7 +945,7 @@ int crypt_get_keys(struct Email *msg, char **keylist, bool oppenc_mode)
 
   *keylist = NULL;
 
-  if (oppenc_mode || (msg->security & ENCRYPT))
+  if (oppenc_mode || (msg->security & SEC_ENCRYPT))
   {
     if (((WithCrypto & APPLICATION_PGP) != 0) && (msg->security & APPLICATION_PGP))
     {
@@ -998,18 +998,18 @@ void crypt_opportunistic_encrypt(struct Email *msg)
   if (!WithCrypto)
     return;
 
-  if (!(CryptOpportunisticEncrypt && (msg->security & OPPENCRYPT)))
+  if (!(CryptOpportunisticEncrypt && (msg->security & SEC_OPPENCRYPT)))
     return;
 
   crypt_get_keys(msg, &pgpkeylist, 1);
   if (pgpkeylist)
   {
-    msg->security |= ENCRYPT;
+    msg->security |= SEC_ENCRYPT;
     FREE(&pgpkeylist);
   }
   else
   {
-    msg->security &= ~ENCRYPT;
+    msg->security &= ~SEC_ENCRYPT;
   }
 }
 
@@ -1045,8 +1045,8 @@ static void crypt_fetch_signatures(struct Body ***signatures, struct Body *a, in
  */
 bool mutt_should_hide_protected_subject(struct Email *e)
 {
-  if (CryptProtectedHeadersWrite && (e->security & ENCRYPT) && !(e->security & INLINE) &&
-      CryptProtectedHeadersSubject && *CryptProtectedHeadersSubject)
+  if (CryptProtectedHeadersWrite && (e->security & SEC_ENCRYPT) &&
+      !(e->security & SEC_INLINE) && CryptProtectedHeadersSubject && *CryptProtectedHeadersSubject)
   {
     return true;
   }
@@ -1111,7 +1111,7 @@ int mutt_signed_handler(struct Body *a, struct State *s)
   {
     switch (signed_type)
     {
-      case SIGN:
+      case SEC_SIGN:
         if (a->next->type != TYPE_MULTIPART ||
             (mutt_str_strcasecmp(a->next->subtype, "mixed") != 0))
         {
diff --git a/ncrypt/crypt_gpgme.c b/ncrypt/crypt_gpgme.c
index 7d7442ca1..b35c96007 100644
--- a/ncrypt/crypt_gpgme.c
+++ b/ncrypt/crypt_gpgme.c
@@ -5367,7 +5367,7 @@ void smime_gpgme_init(void)
  * gpgme_send_menu - Show the user the encryption/signing menu
  * @param msg      Email
  * @param is_smime True if an SMIME message
- * @retval num Flags, e.g. #APPLICATION_SMIME | #ENCRYPT
+ * @retval num Flags, e.g. #APPLICATION_SMIME | #SEC_ENCRYPT
  */
 static int gpgme_send_menu(struct Email *msg, int is_smime)
 {
@@ -5386,7 +5386,7 @@ static int gpgme_send_menu(struct Email *msg, int is_smime)
    * NOTE: "Signing" and "Clearing" only adjust the sign bit, so we have different
    *       letter choices for those.
    */
-  if (CryptOpportunisticEncrypt && (msg->security & OPPENCRYPT))
+  if (CryptOpportunisticEncrypt && (msg->security & SEC_OPPENCRYPT))
   {
     if (is_smime)
     {
@@ -5467,25 +5467,25 @@ static int gpgme_send_menu(struct Email *msg, int is_smime)
           mutt_str_replace(is_smime ? &SmimeDefaultKey : &PgpSignAs, input_signas);
           crypt_free_key(&p);
 
-          msg->security |= SIGN;
+          msg->security |= SEC_SIGN;
         }
         break;
 
       case 'b': /* (b)oth */
-        msg->security |= (ENCRYPT | SIGN);
+        msg->security |= (SEC_ENCRYPT | SEC_SIGN);
         break;
 
       case 'C':
-        msg->security &= ~SIGN;
+        msg->security &= ~SEC_SIGN;
         break;
 
       case 'c': /* (c)lear */
-        msg->security &= ~(ENCRYPT | SIGN);
+        msg->security &= ~(SEC_ENCRYPT | SEC_SIGN);
         break;
 
       case 'e': /* (e)ncrypt */
-        msg->security |= ENCRYPT;
-        msg->security &= ~SIGN;
+        msg->security |= SEC_ENCRYPT;
+        msg->security &= ~SEC_SIGN;
         break;
 
       case 'm': /* (p)gp or s/(m)ime */
@@ -5505,21 +5505,21 @@ static int gpgme_send_menu(struct Email *msg, int is_smime)
         break;
 
       case 'O': /* oppenc mode on */
-        msg->security |= OPPENCRYPT;
+        msg->security |= SEC_OPPENCRYPT;
         crypt_opportunistic_encrypt(msg);
         break;
 
       case 'o': /* oppenc mode off */
-        msg->security &= ~OPPENCRYPT;
+        msg->security &= ~SEC_OPPENCRYPT;
         break;
 
       case 'S': /* (s)ign in oppenc mode */
-        msg->security |= SIGN;
+        msg->security |= SEC_SIGN;
         break;
 
       case 's': /* (s)ign */
-        msg->security &= ~ENCRYPT;
-        msg->security |= SIGN;
+        msg->security &= ~SEC_ENCRYPT;
+        msg->security |= SEC_SIGN;
         break;
     }
   }
diff --git a/ncrypt/crypt_mod.h b/ncrypt/crypt_mod.h
index f474afaeb..a0a1bb54f 100644
--- a/ncrypt/crypt_mod.h
+++ b/ncrypt/crypt_mod.h
@@ -114,7 +114,7 @@ struct CryptModuleSpecs
   /**
    * send_menu - Ask the user whether to sign and/or encrypt the email
    * @param msg Email
-   * @retval num Flags, e.g. #APPLICATION_PGP | #ENCRYPT
+   * @retval num Flags, e.g. #APPLICATION_PGP | #SEC_ENCRYPT
    */
   int          (*send_menu)(struct Email *msg);
   /**
@@ -152,7 +152,7 @@ struct CryptModuleSpecs
   /**
    * pgp_traditional_encryptsign - Create an inline PGP encrypted, signed email
    * @param a       Body of the email
-   * @param flags   Flags, e.g. #ENCRYPT
+   * @param flags   Flags, e.g. #SEC_ENCRYPT
    * @param keylist List of keys to encrypt to (space-separated)
    * @retval ptr  New encrypted/siged Body
    * @retval NULL Error
diff --git a/ncrypt/ncrypt.h b/ncrypt/ncrypt.h
index 9905698ed..1f2262756 100644
--- a/ncrypt/ncrypt.h
+++ b/ncrypt/ncrypt.h
@@ -114,30 +114,30 @@ extern long  SmimeTimeout;
 extern char *SmimeVerifyCommand;
 extern char *SmimeVerifyOpaqueCommand;
 
-#define ENCRYPT                 (1 << 0)  ///< Email is encrypted
-#define SIGN                    (1 << 1)  ///< Email is signed
-#define GOODSIGN                (1 << 2)  ///< Email has a valid signature
-#define BADSIGN                 (1 << 3)  ///< Email has a bad signature
-#define PARTSIGN                (1 << 4)  ///< Not all parts of the email is signed
-#define SIGNOPAQUE              (1 << 5)  ///< Email has an opaque signature (encrypted)
-#define KEYBLOCK                (1 << 6)  ///< Email has a key attached
-#define INLINE                  (1 << 7)  ///< Email has an inline signature
-#define OPPENCRYPT              (1 << 8)  ///< Opportunistic encrypt mode
+#define SEC_ENCRYPT             (1 << 0)  ///< Email is encrypted
+#define SEC_SIGN                (1 << 1)  ///< Email is signed
+#define SEC_GOODSIGN            (1 << 2)  ///< Email has a valid signature
+#define SEC_BADSIGN             (1 << 3)  ///< Email has a bad signature
+#define SEC_PARTSIGN            (1 << 4)  ///< Not all parts of the email is signed
+#define SEC_SIGNOPAQUE          (1 << 5)  ///< Email has an opaque signature (encrypted)
+#define SEC_KEYBLOCK            (1 << 6)  ///< Email has a key attached
+#define SEC_INLINE              (1 << 7)  ///< Email has an inline signature
+#define SEC_OPPENCRYPT          (1 << 8)  ///< Opportunistic encrypt mode
 #define APPLICATION_PGP         (1 << 9)  ///< Use PGP to encrypt/sign
 #define APPLICATION_SMIME       (1 << 10) ///< Use SMIME to encrypt/sign
 #define PGP_TRADITIONAL_CHECKED (1 << 11) ///< Email has a traditional (inline) signature
 
-#define PGP_ENCRYPT  (APPLICATION_PGP | ENCRYPT)
-#define PGP_SIGN     (APPLICATION_PGP | SIGN)
-#define PGP_GOODSIGN (APPLICATION_PGP | GOODSIGN)
-#define PGP_KEY      (APPLICATION_PGP | KEYBLOCK)
-#define PGP_INLINE   (APPLICATION_PGP | INLINE)
-
-#define SMIME_ENCRYPT  (APPLICATION_SMIME | ENCRYPT)
-#define SMIME_SIGN     (APPLICATION_SMIME | SIGN)
-#define SMIME_GOODSIGN (APPLICATION_SMIME | GOODSIGN)
-#define SMIME_BADSIGN  (APPLICATION_SMIME | BADSIGN)
-#define SMIME_OPAQUE   (APPLICATION_SMIME | SIGNOPAQUE)
+#define PGP_ENCRYPT  (APPLICATION_PGP | SEC_ENCRYPT)
+#define PGP_SIGN     (APPLICATION_PGP | SEC_SIGN)
+#define PGP_GOODSIGN (APPLICATION_PGP | SEC_GOODSIGN)
+#define PGP_KEY      (APPLICATION_PGP | SEC_KEYBLOCK)
+#define PGP_INLINE   (APPLICATION_PGP | SEC_INLINE)
+
+#define SMIME_ENCRYPT  (APPLICATION_SMIME | SEC_ENCRYPT)
+#define SMIME_SIGN     (APPLICATION_SMIME | SEC_SIGN)
+#define SMIME_GOODSIGN (APPLICATION_SMIME | SEC_GOODSIGN)
+#define SMIME_BADSIGN  (APPLICATION_SMIME | SEC_BADSIGN)
+#define SMIME_OPAQUE   (APPLICATION_SMIME | SEC_SIGNOPAQUE)
 
 /* WITHCRYPTO actually replaces ifdefs so make the code more readable.
  * Because it is defined as a constant and known at compile time, the
diff --git a/ncrypt/pgp.c b/ncrypt/pgp.c
index 61d53ccfa..b52c086aa 100644
--- a/ncrypt/pgp.c
+++ b/ncrypt/pgp.c
@@ -1724,7 +1724,7 @@ struct Body *pgp_class_traditional_encryptsign(struct Body *a, int flags, char *
     int c;
     struct FgetConv *fc = NULL;
 
-    if (flags & ENCRYPT)
+    if (flags & SEC_ENCRYPT)
       send_charset = "us-ascii";
     else
       send_charset = "utf-8";
@@ -1774,7 +1774,7 @@ struct Body *pgp_class_traditional_encryptsign(struct Body *a, int flags, char *
 
   if (pgp_use_gpg_agent())
     *PgpPass = 0;
-  if (flags & SIGN)
+  if (flags & SEC_SIGN)
     fprintf(pgpin, "%s\n", PgpPass);
   mutt_file_fclose(&pgpin);
 
@@ -1808,7 +1808,7 @@ struct Body *pgp_class_traditional_encryptsign(struct Body *a, int flags, char *
 
   if (empty)
   {
-    if (flags & SIGN)
+    if (flags & SEC_SIGN)
       pgp_class_void_passphrase(); /* just in case */
     unlink(pgpoutfile);
     return NULL;
@@ -1821,7 +1821,8 @@ struct Body *pgp_class_traditional_encryptsign(struct Body *a, int flags, char *
   b->type = TYPE_TEXT;
   b->subtype = mutt_str_strdup("plain");
 
-  mutt_param_set(&b->parameter, "x-action", (flags & ENCRYPT) ? "pgp-encrypted" : "pgp-signed");
+  mutt_param_set(&b->parameter, "x-action",
+                 (flags & SEC_ENCRYPT) ? "pgp-encrypted" : "pgp-signed");
   mutt_param_set(&b->parameter, "charset", send_charset);
 
   b->filename = mutt_str_strdup(pgpoutfile);
@@ -1832,7 +1833,7 @@ struct Body *pgp_class_traditional_encryptsign(struct Body *a, int flags, char *
   b->noconv = true;
   b->use_disp = false;
 
-  if (!(flags & ENCRYPT))
+  if (!(flags & SEC_ENCRYPT))
     b->encoding = a->encoding;
 
   return b;
@@ -1854,16 +1855,16 @@ int pgp_class_send_menu(struct Email *msg)
     return msg->security;
 
   /* If autoinline and no crypto options set, then set inline. */
-  if (PgpAutoinline &&
-      !((msg->security & APPLICATION_PGP) && (msg->security & (SIGN | ENCRYPT))))
+  if (PgpAutoinline && !((msg->security & APPLICATION_PGP) &&
+                         (msg->security & (SEC_SIGN | SEC_ENCRYPT))))
   {
-    msg->security |= INLINE;
+    msg->security |= SEC_INLINE;
   }
 
   msg->security |= APPLICATION_PGP;
 
   char *mime_inline = NULL;
-  if (msg->security & INLINE)
+  if (msg->security & SEC_INLINE)
   {
     /* L10N: The next string MUST have the same highlighted letter
              One of them will appear in each of the three strings marked "(inline"), below. */
@@ -1880,9 +1881,9 @@ int pgp_class_send_menu(struct Email *msg)
    * NOTE: "Signing" and "Clearing" only adjust the sign bit, so we have different
    *       letter choices for those.
    */
-  if (CryptOpportunisticEncrypt && (msg->security & OPPENCRYPT))
+  if (CryptOpportunisticEncrypt && (msg->security & SEC_OPPENCRYPT))
   {
-    if (msg->security & (ENCRYPT | SIGN))
+    if (msg->security & (SEC_ENCRYPT | SEC_SIGN))
     {
       snprintf(promptbuf, sizeof(promptbuf),
                /* L10N: PGP options (inline) (opportunistic encryption is on) */
@@ -1912,7 +1913,7 @@ int pgp_class_send_menu(struct Email *msg)
     /* When the message is not selected for signing or encryption, the toggle
      * between PGP/MIME and Traditional doesn't make sense.
      */
-    if (msg->security & (ENCRYPT | SIGN))
+    if (msg->security & (SEC_ENCRYPT | SEC_SIGN))
     {
       snprintf(promptbuf, sizeof(promptbuf),
                /* L10N: PGP options (inline) (opportunistic encryption is off) */
@@ -1938,7 +1939,7 @@ int pgp_class_send_menu(struct Email *msg)
   /* Opportunistic encryption is unset */
   else
   {
-    if (msg->security & (ENCRYPT | SIGN))
+    if (msg->security & (SEC_ENCRYPT | SEC_SIGN))
     {
       snprintf(promptbuf, sizeof(promptbuf),
                /* L10N: PGP options (inline) */
@@ -1977,49 +1978,49 @@ int pgp_class_send_menu(struct Email *msg)
           mutt_str_replace(&PgpSignAs, input_signas);
           pgp_free_key(&p);
 
-          msg->security |= SIGN;
+          msg->security |= SEC_SIGN;
 
           crypt_pgp_void_passphrase(); /* probably need a different passphrase */
         }
         break;
 
       case 'b': /* (b)oth */
-        msg->security |= (ENCRYPT | SIGN);
+        msg->security |= (SEC_ENCRYPT | SEC_SIGN);
         break;
 
       case 'C':
-        msg->security &= ~SIGN;
+        msg->security &= ~SEC_SIGN;
         break;
 
       case 'c': /* (c)lear     */
-        msg->security &= ~(ENCRYPT | SIGN);
+        msg->security &= ~(SEC_ENCRYPT | SEC_SIGN);
         break;
 
       case 'e': /* (e)ncrypt */
-        msg->security |= ENCRYPT;
-        msg->security &= ~SIGN;
+        msg->security |= SEC_ENCRYPT;
+        msg->security &= ~SEC_SIGN;
         break;
 
       case 'i': /* toggle (i)nline */
-        msg->security ^= INLINE;
+        msg->security ^= SEC_INLINE;
         break;
 
       case 'O': /* oppenc mode on */
-        msg->security |= OPPENCRYPT;
+        msg->security |= SEC_OPPENCRYPT;
         crypt_opportunistic_encrypt(msg);
         break;
 
       case 'o': /* oppenc mode off */
-        msg->security &= ~OPPENCRYPT;
+        msg->security &= ~SEC_OPPENCRYPT;
         break;
 
       case 'S': /* (s)ign in oppenc mode */
-        msg->security |= SIGN;
+        msg->security |= SEC_SIGN;
         break;
 
       case 's': /* (s)ign */
-        msg->security &= ~ENCRYPT;
-        msg->security |= SIGN;
+        msg->security &= ~SEC_ENCRYPT;
+        msg->security |= SEC_SIGN;
         break;
     }
   }
diff --git a/ncrypt/pgpinvoke.c b/ncrypt/pgpinvoke.c
index c779b6ae5..6f098aa19 100644
--- a/ncrypt/pgpinvoke.c
+++ b/ncrypt/pgpinvoke.c
@@ -369,7 +369,7 @@ pid_t pgp_invoke_encrypt(FILE **pgpin, FILE **pgpout, FILE **pgperr,
  * @param[in]  pgperrfd stderr for the command, or -1 (OPTIONAL)
  * @param[in]  fname    Filename to pass to the command
  * @param[in]  uids     List of IDs/fingerprints, space separated
- * @param[in]  flags    Flags, e.g. #SIGN, #ENCRYPT
+ * @param[in]  flags    Flags, e.g. #SEC_SIGN, #SEC_ENCRYPT
  * @retval num PID of the created process
  * @retval -1  Error creating pipes or forking
  *
@@ -380,11 +380,11 @@ pid_t pgp_invoke_traditional(FILE **pgpin, FILE **pgpout, FILE **pgperr,
                              int pgpinfd, int pgpoutfd, int pgperrfd,
                              const char *fname, const char *uids, int flags)
 {
-  if (flags & ENCRYPT)
+  if (flags & SEC_ENCRYPT)
   {
     return pgp_invoke(pgpin, pgpout, pgperr, pgpinfd, pgpoutfd, pgperrfd,
-                      (flags & SIGN), fname, NULL, uids,
-                      (flags & SIGN) ? PgpEncryptSignCommand : PgpEncryptOnlyCommand);
+                      (flags & SEC_SIGN), fname, NULL, uids,
+                      (flags & SEC_SIGN) ? PgpEncryptSignCommand : PgpEncryptOnlyCommand);
   }
   else
   {
diff --git a/ncrypt/smime.c b/ncrypt/smime.c
index 9c2977562..e947023e4 100644
--- a/ncrypt/smime.c
+++ b/ncrypt/smime.c
@@ -1437,7 +1437,7 @@ int smime_class_verify_sender(struct Email *e)
     return 1;
   }
 
-  if (e->security & ENCRYPT)
+  if (e->security & SEC_ENCRYPT)
   {
     mutt_copy_message_ctx(fpout, Context->mailbox, e, MUTT_CM_DECODE_CRYPT & MUTT_CM_DECODE_SMIME,
                           CH_MIME | CH_WEED | CH_NONEWLINE);
@@ -2043,7 +2043,7 @@ static struct Body *smime_handle_entity(struct Body *m, struct State *s, FILE *o
   mutt_file_fclose(&tmpfp);
 
   FILE *smimein = NULL;
-  if ((type & ENCRYPT) &&
+  if ((type & SEC_ENCRYPT) &&
       (thepid = smime_invoke_decrypt(&smimein, NULL, NULL, -1, fileno(smimeout),
                                      fileno(smimeerr), tmpfname)) == -1)
   {
@@ -2057,9 +2057,10 @@ static struct Body *smime_handle_entity(struct Body *m, struct State *s, FILE *o
     mutt_file_fclose(&smimeerr);
     return NULL;
   }
-  else if ((type & SIGNOPAQUE) &&
-           (thepid = smime_invoke_verify(&smimein, NULL, NULL, -1, fileno(smimeout),
-                                         fileno(smimeerr), NULL, tmpfname, SIGNOPAQUE)) == -1)
+  else if ((type & SEC_SIGNOPAQUE) &&
+           (thepid = smime_invoke_verify(&smimein, NULL, NULL, -1,
+                                         fileno(smimeout), fileno(smimeerr),
+                                         NULL, tmpfname, SEC_SIGNOPAQUE)) == -1)
   {
     mutt_file_fclose(&smimeout);
     mutt_file_unlink(tmpfname);
@@ -2072,7 +2073,7 @@ static struct Body *smime_handle_entity(struct Body *m, struct State *s, FILE *o
     return NULL;
   }
 
-  if (type & ENCRYPT)
+  if (type & SEC_ENCRYPT)
   {
     if (!smime_class_valid_passphrase())
       smime_class_void_passphrase();
@@ -2100,7 +2101,7 @@ static struct Body *smime_handle_entity(struct Body *m, struct State *s, FILE *o
       state_attach_puts(_("[-- End of OpenSSL output --]\n\n"), s);
     }
 
-    if (type & ENCRYPT)
+    if (type & SEC_ENCRYPT)
     {
       state_attach_puts(_("[-- The following data is S/MIME"
                           " encrypted --]\n"),
@@ -2113,7 +2114,7 @@ static struct Body *smime_handle_entity(struct Body *m, struct State *s, FILE *o
   fflush(smimeout);
   rewind(smimeout);
 
-  if (type & ENCRYPT)
+  if (type & SEC_ENCRYPT)
   {
     /* void the passphrase, even if that wasn't the problem */
     if (fgetc(smimeout) == EOF)
@@ -2200,13 +2201,13 @@ static struct Body *smime_handle_entity(struct Body *m, struct State *s, FILE *o
 
   if (s->flags & MUTT_DISPLAY)
   {
-    if (type & ENCRYPT)
+    if (type & SEC_ENCRYPT)
       state_attach_puts(_("\n[-- End of S/MIME encrypted data. --]\n"), s);
     else
       state_attach_puts(_("\n[-- End of S/MIME signed data. --]\n"), s);
   }
 
-  if (type & SIGNOPAQUE)
+  if (type & SEC_SIGNOPAQUE)
   {
     char *line = NULL;
     int lineno = 0;
@@ -2333,7 +2334,7 @@ int smime_class_send_menu(struct Email *msg)
    * NOTE: "Signing" and "Clearing" only adjust the sign bit, so we have different
    *       letter choices for those.
    */
-  if (CryptOpportunisticEncrypt && (msg->security & OPPENCRYPT))
+  if (CryptOpportunisticEncrypt && (msg->security & SEC_OPPENCRYPT))
   {
     /* L10N: S/MIME options (opportunistic encryption is on) */
     prompt = _("S/MIME (s)ign, encrypt (w)ith, sign (a)s, (c)lear, or (o)ppenc "
@@ -2377,7 +2378,7 @@ int smime_class_send_menu(struct Email *msg)
           mutt_str_replace(&SmimeSignAs, key->hash);
           smime_free_key(&key);
 
-          msg->security |= SIGN;
+          msg->security |= SEC_SIGN;
 
           /* probably need a different passphrase */
           crypt_smime_void_passphrase();
@@ -2386,43 +2387,43 @@ int smime_class_send_menu(struct Email *msg)
         break;
 
       case 'b': /* (b)oth */
-        msg->security |= (ENCRYPT | SIGN);
+        msg->security |= (SEC_ENCRYPT | SEC_SIGN);
         break;
 
       case 'c': /* (c)lear */
-        msg->security &= ~(ENCRYPT | SIGN);
+        msg->security &= ~(SEC_ENCRYPT | SEC_SIGN);
         break;
 
       case 'C':
-        msg->security &= ~SIGN;
+        msg->security &= ~SEC_SIGN;
         break;
 
       case 'e': /* (e)ncrypt */
-        msg->security |= ENCRYPT;
-        msg->security &= ~SIGN;
+        msg->security |= SEC_ENCRYPT;
+        msg->security &= ~SEC_SIGN;
         break;
 
       case 'O': /* oppenc mode on */
-        msg->security |= OPPENCRYPT;
+        msg->security |= SEC_OPPENCRYPT;
         crypt_opportunistic_encrypt(msg);
         break;
 
       case 'o': /* oppenc mode off */
-        msg->security &= ~OPPENCRYPT;
+        msg->security &= ~SEC_OPPENCRYPT;
         break;
 
       case 'S': /* (s)ign in oppenc mode */
-        msg->security |= SIGN;
+        msg->security |= SEC_SIGN;
         break;
 
       case 's': /* (s)ign */
-        msg->security &= ~ENCRYPT;
-        msg->security |= SIGN;
+        msg->security &= ~SEC_ENCRYPT;
+        msg->security |= SEC_SIGN;
         break;
 
       case 'w': /* encrypt (w)ith */
       {
-        msg->security |= ENCRYPT;
+        msg->security |= SEC_ENCRYPT;
         do
         {
           switch (mutt_multi_choice(_("Choose algorithm family: 1: DES, 2: "
diff --git a/pattern.c b/pattern.c
index 6d33ac733..71e410d5e 100644
--- a/pattern.c
+++ b/pattern.c
@@ -1132,7 +1132,8 @@ static bool msg_search(struct Mailbox *m, struct Pattern *pat, int msgno)
     {
       mutt_parse_mime_message(m, e);
 
-      if ((WithCrypto != 0) && (e->security & ENCRYPT) && !crypt_valid_passphrase(e->security))
+      if ((WithCrypto != 0) && (e->security & SEC_ENCRYPT) &&
+          !crypt_valid_passphrase(e->security))
       {
         mx_msg_close(m, &msg);
         if (s.fpout)
@@ -2123,15 +2124,15 @@ int mutt_pattern_exec(struct Pattern *pat, enum PatternExecFlag flags,
     case MUTT_CRYPT_SIGN:
       if (!WithCrypto)
         break;
-      return pat->not^((e->security & SIGN) ? 1 : 0);
+      return pat->not^((e->security & SEC_SIGN) ? 1 : 0);
     case MUTT_CRYPT_VERIFIED:
       if (!WithCrypto)
         break;
-      return pat->not^((e->security & GOODSIGN) ? 1 : 0);
+      return pat->not^((e->security & SEC_GOODSIGN) ? 1 : 0);
     case MUTT_CRYPT_ENCRYPT:
       if (!WithCrypto)
         break;
-      return pat->not^((e->security & ENCRYPT) ? 1 : 0);
+      return pat->not^((e->security & SEC_ENCRYPT) ? 1 : 0);
     case MUTT_PGP_KEY:
       if (!(WithCrypto & APPLICATION_PGP))
         break;
diff --git a/postpone.c b/postpone.c
index d6f4fc63f..0639db0fc 100644
--- a/postpone.c
+++ b/postpone.c
@@ -447,7 +447,7 @@ int mutt_get_postponed(struct Context *ctx, struct Email *hdr,
  * @param p                Header string to parse
  * @param set_empty_signas Allow an empty "Sign as"
  * @param crypt_app App, e.g. #APPLICATION_PGP
- * @retval num Flags, e.g. #ENCRYPT
+ * @retval num Flags, e.g. #SEC_ENCRYPT
  */
 int mutt_parse_crypt_hdr(const char *p, int set_empty_signas, int crypt_app)
 {
@@ -487,12 +487,12 @@ int mutt_parse_crypt_hdr(const char *p, int set_empty_signas, int crypt_app)
 
       case 'e':
       case 'E':
-        flags |= ENCRYPT;
+        flags |= SEC_ENCRYPT;
         break;
 
       case 'i':
       case 'I':
-        flags |= INLINE;
+        flags |= SEC_INLINE;
         break;
 
       /* This used to be the micalg parameter.
@@ -517,12 +517,12 @@ int mutt_parse_crypt_hdr(const char *p, int set_empty_signas, int crypt_app)
 
       case 'o':
       case 'O':
-        flags |= OPPENCRYPT;
+        flags |= SEC_OPPENCRYPT;
         break;
 
       case 's':
       case 'S':
-        flags |= SIGN;
+        flags |= SEC_SIGN;
         q = sign_as;
 
         if (*(p + 1) == '<')
@@ -555,13 +555,13 @@ int mutt_parse_crypt_hdr(const char *p, int set_empty_signas, int crypt_app)
   /* Set {Smime,Pgp}SignAs, if desired. */
 
   if (((WithCrypto & APPLICATION_PGP) != 0) && (crypt_app == APPLICATION_PGP) &&
-      (flags & SIGN) && (set_empty_signas || *sign_as))
+      (flags & SEC_SIGN) && (set_empty_signas || *sign_as))
   {
     mutt_str_replace(&PgpSignAs, sign_as);
   }
 
   if (((WithCrypto & APPLICATION_SMIME) != 0) && (crypt_app == APPLICATION_SMIME) &&
-      (flags & SIGN) && (set_empty_signas || *sign_as))
+      (flags & SEC_SIGN) && (set_empty_signas || *sign_as))
   {
     mutt_str_replace(&SmimeSignAs, sign_as);
   }
@@ -652,7 +652,7 @@ int mutt_prepare_template(FILE *fp, struct Mailbox *m, struct Email *newhdr,
    */
   if ((WithCrypto != 0) && mutt_is_multipart_signed(newhdr->content))
   {
-    newhdr->security |= SIGN;
+    newhdr->security |= SEC_SIGN;
     if (((WithCrypto & APPLICATION_PGP) != 0) &&
         (mutt_str_strcasecmp(
              mutt_param_get(&newhdr->content->parameter, "protocol"),
@@ -732,9 +732,9 @@ int mutt_prepare_template(FILE *fp, struct Mailbox *m, struct Email *newhdr,
       goto bail;
 
     if (((WithCrypto & APPLICATION_PGP) != 0) &&
-        ((sec_type = mutt_is_application_pgp(b)) & (ENCRYPT | SIGN)))
+        ((sec_type = mutt_is_application_pgp(b)) & (SEC_ENCRYPT | SEC_SIGN)))
     {
-      if (sec_type & ENCRYPT)
+      if (sec_type & SEC_ENCRYPT)
       {
         if (!crypt_valid_passphrase(APPLICATION_PGP))
           goto bail;
@@ -759,9 +759,9 @@ int mutt_prepare_template(FILE *fp, struct Mailbox *m, struct Email *newhdr,
       mutt_param_delete(&b->parameter, "x-action");
     }
     else if (((WithCrypto & APPLICATION_SMIME) != 0) &&
-             ((sec_type = mutt_is_application_smime(b)) & (ENCRYPT | SIGN)))
+             ((sec_type = mutt_is_application_smime(b)) & (SEC_ENCRYPT | SEC_SIGN)))
     {
-      if (sec_type & ENCRYPT)
+      if (sec_type & SEC_ENCRYPT)
       {
         if (!crypt_valid_passphrase(APPLICATION_SMIME))
           goto bail;
@@ -805,8 +805,8 @@ int mutt_prepare_template(FILE *fp, struct Mailbox *m, struct Email *newhdr,
   /* Fix encryption flags. */
 
   /* No inline if multipart. */
-  if ((WithCrypto != 0) && (newhdr->security & INLINE) && newhdr->content->next)
-    newhdr->security &= ~INLINE;
+  if ((WithCrypto != 0) && (newhdr->security & SEC_INLINE) && newhdr->content->next)
+    newhdr->security &= ~SEC_INLINE;
 
   /* Do we even support multiple mechanisms? */
   newhdr->security &= WithCrypto | ~(APPLICATION_PGP | APPLICATION_SMIME);
diff --git a/recvattach.c b/recvattach.c
index e33f8f45e..8a6729bc6 100644
--- a/recvattach.c
+++ b/recvattach.c
@@ -1147,7 +1147,7 @@ static void mutt_generate_recvattach_list(struct AttachCtx *actx, struct Email *
     {
       need_secured = 1;
 
-      if (type & ENCRYPT)
+      if (type & SEC_ENCRYPT)
       {
         if (!crypt_valid_passphrase(APPLICATION_SMIME))
           goto decrypt_failed;
@@ -1170,7 +1170,7 @@ static void mutt_generate_recvattach_list(struct AttachCtx *actx, struct Email *
         goto decrypt_failed;
       }
 
-      if (secured && (type & ENCRYPT))
+      if (secured && (type & SEC_ENCRYPT))
         e->security |= SMIME_ENCRYPT;
     }
 
@@ -1442,13 +1442,13 @@ void mutt_view_attachments(struct Email *e)
         }
 #endif
 
-        if ((WithCrypto != 0) && (e->security & ENCRYPT))
+        if ((WithCrypto != 0) && (e->security & SEC_ENCRYPT))
         {
           mutt_message(_("Deletion of attachments from encrypted messages is "
                          "unsupported"));
           break;
         }
-        if ((WithCrypto != 0) && (e->security & (SIGN | PARTSIGN)))
+        if ((WithCrypto != 0) && (e->security & (SEC_SIGN | SEC_PARTSIGN)))
         {
           mutt_message(_("Deletion of attachments from signed messages may "
                          "invalidate the signature"));
diff --git a/send.c b/send.c
index 3b8cb9783..deb344db6 100644
--- a/send.c
+++ b/send.c
@@ -500,7 +500,7 @@ static int include_forward(struct Mailbox *m, struct Email *e, FILE *out)
   mutt_parse_mime_message(m, e);
   mutt_message_hook(m, e, MUTT_MESSAGE_HOOK);
 
-  if ((WithCrypto != 0) && (e->security & ENCRYPT) && ForwardDecode)
+  if ((WithCrypto != 0) && (e->security & SEC_ENCRYPT) && ForwardDecode)
   {
     /* make sure we have the user's passphrase before proceeding... */
     if (!crypt_valid_passphrase(e->security))
@@ -579,7 +579,7 @@ static int include_reply(struct Mailbox *m, struct Email *e, FILE *out)
   int cmflags = MUTT_CM_PREFIX | MUTT_CM_DECODE | MUTT_CM_CHARCONV | MUTT_CM_REPLYING;
   int chflags = CH_DECODE;
 
-  if ((WithCrypto != 0) && (e->security & ENCRYPT))
+  if ((WithCrypto != 0) && (e->security & SEC_ENCRYPT))
   {
     /* make sure we have the user's passphrase before proceeding... */
     if (!crypt_valid_passphrase(e->security))
@@ -1391,7 +1391,7 @@ int mutt_resend_message(FILE *fp, struct Context *ctx, struct Email *cur)
 
     if (CryptOpportunisticEncrypt)
     {
-      msg->security |= OPPENCRYPT;
+      msg->security |= SEC_OPPENCRYPT;
       crypt_opportunistic_encrypt(msg);
     }
   }
@@ -1504,24 +1504,24 @@ static int save_fcc(struct Email *msg, char *fcc, size_t fcc_len, struct Body *c
   struct Body *save_sig = NULL;
   struct Body *save_parts = NULL;
 
-  if ((WithCrypto != 0) && (msg->security & (ENCRYPT | SIGN)) && FccClear)
+  if ((WithCrypto != 0) && (msg->security & (SEC_ENCRYPT | SEC_SIGN)) && FccClear)
   {
     msg->content = clear_content;
-    msg->security &= ~(ENCRYPT | SIGN);
+    msg->security &= ~(SEC_ENCRYPT | SEC_SIGN);
     mutt_env_free(&msg->content->mime_headers);
   }
 
   /* check to see if the user wants copies of all attachments */
   if (msg->content->type == TYPE_MULTIPART)
   {
-    if ((WithCrypto != 0) && (msg->security & (ENCRYPT | SIGN)) &&
+    if ((WithCrypto != 0) && (msg->security & (SEC_ENCRYPT | SEC_SIGN)) &&
         ((mutt_str_strcmp(msg->content->subtype, "encrypted") == 0) ||
          (mutt_str_strcmp(msg->content->subtype, "signed") == 0)))
     {
       if ((clear_content->type == TYPE_MULTIPART) &&
           query_quadoption(FccAttach, _("Save attachments in Fcc?")) == MUTT_NO)
       {
-        if (!(msg->security & ENCRYPT) && (msg->security & SIGN))
+        if (!(msg->security & SEC_ENCRYPT) && (msg->security & SEC_SIGN))
         {
           /* save initial signature and attachments */
           save_sig = msg->content->parts->next;
@@ -1654,7 +1654,7 @@ static int postpone_message(struct Email *msg, struct Email *cur, char *fcc, int
 
   mutt_encode_descriptions(msg->content, true);
 
-  if ((WithCrypto != 0) && PostponeEncrypt && (msg->security & ENCRYPT))
+  if ((WithCrypto != 0) && PostponeEncrypt && (msg->security & SEC_ENCRYPT))
   {
     if (((WithCrypto & APPLICATION_PGP) != 0) && (msg->security & APPLICATION_PGP))
       encrypt_as = PgpDefaultKey;
@@ -1665,16 +1665,16 @@ static int postpone_message(struct Email *msg, struct Email *cur, char *fcc, int
 
     if (encrypt_as && *encrypt_as)
     {
-      is_signed = msg->security & SIGN;
+      is_signed = msg->security & SEC_SIGN;
       if (is_signed)
-        msg->security &= ~SIGN;
+        msg->security &= ~SEC_SIGN;
 
       pgpkeylist = mutt_str_strdup(encrypt_as);
       clear_content = msg->content;
       if (mutt_protect(msg, pgpkeylist) == -1)
       {
         if (is_signed)
-          msg->security |= SIGN;
+          msg->security |= SEC_SIGN;
         FREE(&pgpkeylist);
         msg->content = mutt_remove_multipart(msg->content);
         decode_descriptions(msg->content);
@@ -1682,7 +1682,7 @@ static int postpone_message(struct Email *msg, struct Email *cur, char *fcc, int
       }
 
       if (is_signed)
-        msg->security |= SIGN;
+        msg->security |= SEC_SIGN;
       FREE(&pgpkeylist);
 
       mutt_encode_descriptions(msg->content, false);
@@ -2158,22 +2158,22 @@ int ci_send_message(int flags, struct Email *msg, const char *tempfile,
       !(flags & (SEND_BATCH | SEND_MAILX | SEND_POSTPONED | SEND_RESEND)))
   {
     if (CryptAutosign)
-      msg->security |= SIGN;
+      msg->security |= SEC_SIGN;
     if (CryptAutoencrypt)
-      msg->security |= ENCRYPT;
-    if (CryptReplyencrypt && cur && (cur->security & ENCRYPT))
-      msg->security |= ENCRYPT;
-    if (CryptReplysign && cur && (cur->security & SIGN))
-      msg->security |= SIGN;
-    if (CryptReplysignencrypted && cur && (cur->security & ENCRYPT))
-      msg->security |= SIGN;
+      msg->security |= SEC_ENCRYPT;
+    if (CryptReplyencrypt && cur && (cur->security & SEC_ENCRYPT))
+      msg->security |= SEC_ENCRYPT;
+    if (CryptReplysign && cur && (cur->security & SEC_SIGN))
+      msg->security |= SEC_SIGN;
+    if (CryptReplysignencrypted && cur && (cur->security & SEC_ENCRYPT))
+      msg->security |= SEC_SIGN;
     if (((WithCrypto & APPLICATION_PGP) != 0) &&
-        ((msg->security & (ENCRYPT | SIGN)) || CryptOpportunisticEncrypt))
+        ((msg->security & (SEC_ENCRYPT | SEC_SIGN)) || CryptOpportunisticEncrypt))
     {
       if (PgpAutoinline)
-        msg->security |= INLINE;
-      if (PgpReplyinline && cur && (cur->security & INLINE))
-        msg->security |= INLINE;
+        msg->security |= SEC_INLINE;
+      if (PgpReplyinline && cur && (cur->security & SEC_INLINE))
+        msg->security |= SEC_INLINE;
     }
 
     if (msg->security || CryptOpportunisticEncrypt)
@@ -2227,9 +2227,9 @@ int ci_send_message(int flags, struct Email *msg, const char *tempfile,
        * or CryptReplyencrypt, then don't enable opportunistic encrypt for
        * the message.
        */
-      if (!(msg->security & ENCRYPT))
+      if (!(msg->security & SEC_ENCRYPT))
       {
-        msg->security |= OPPENCRYPT;
+        msg->security |= SEC_OPPENCRYPT;
         crypt_opportunistic_encrypt(msg);
       }
     }
@@ -2386,7 +2386,7 @@ int ci_send_message(int flags, struct Email *msg, const char *tempfile,
 
   if (WithCrypto)
   {
-    if (msg->security & (ENCRYPT | SIGN))
+    if (msg->security & (SEC_ENCRYPT | SEC_SIGN))
     {
       /* save the decrypted attachments */
       clear_content = msg->content;
@@ -2428,13 +2428,13 @@ int ci_send_message(int flags, struct Email *msg, const char *tempfile,
     {
       if (!WithCrypto)
         ;
-      else if ((msg->security & ENCRYPT) ||
-               ((msg->security & SIGN) && msg->content->type == TYPE_APPLICATION))
+      else if ((msg->security & SEC_ENCRYPT) ||
+               ((msg->security & SEC_SIGN) && msg->content->type == TYPE_APPLICATION))
       {
         mutt_body_free(&msg->content); /* destroy PGP data */
         msg->content = clear_content;  /* restore clear text. */
       }
-      else if ((msg->security & SIGN) && msg->content->type == TYPE_MULTIPART)
+      else if ((msg->security & SEC_SIGN) && msg->content->type == TYPE_MULTIPART)
       {
         mutt_body_free(&msg->content->parts->next); /* destroy sig */
         msg->content = mutt_remove_multipart(msg->content);
diff --git a/sendlib.c b/sendlib.c
index 49eebab9d..d6da1690d 100644
--- a/sendlib.c
+++ b/sendlib.c
@@ -1469,7 +1469,7 @@ struct Body *mutt_make_message_attach(struct Mailbox *m, struct Email *e, bool a
 
   if (WithCrypto)
   {
-    if ((MimeForwardDecode || ForwardDecrypt) && (e->security & ENCRYPT))
+    if ((MimeForwardDecode || ForwardDecrypt) && (e->security & SEC_ENCRYPT))
     {
       if (!crypt_valid_passphrase(e->security))
         return NULL;
@@ -1505,7 +1505,7 @@ struct Body *mutt_make_message_attach(struct Mailbox *m, struct Email *e, bool a
     if (WithCrypto & APPLICATION_SMIME)
       pgp &= ~SMIME_ENCRYPT;
   }
-  else if ((WithCrypto != 0) && ForwardDecrypt && (e->security & ENCRYPT))
+  else if ((WithCrypto != 0) && ForwardDecrypt && (e->security & SEC_ENCRYPT))
   {
     if (((WithCrypto & APPLICATION_PGP) != 0) && mutt_is_multipart_encrypted(e->content))
     {
@@ -3232,17 +3232,17 @@ int mutt_write_fcc(const char *path, struct Email *e, const char *msgid,
   if (((WithCrypto & APPLICATION_PGP) != 0) && post && (e->security & APPLICATION_PGP))
   {
     fputs("X-Mutt-PGP: ", msg->fp);
-    if (e->security & ENCRYPT)
+    if (e->security & SEC_ENCRYPT)
       fputc('E', msg->fp);
-    if (e->security & OPPENCRYPT)
+    if (e->security & SEC_OPPENCRYPT)
       fputc('O', msg->fp);
-    if (e->security & SIGN)
+    if (e->security & SEC_SIGN)
     {
       fputc('S', msg->fp);
       if (PgpSignAs && *PgpSignAs)
         fprintf(msg->fp, "<%s>", PgpSignAs);
     }
-    if (e->security & INLINE)
+    if (e->security & SEC_INLINE)
       fputc('I', msg->fp);
     fputc('\n', msg->fp);
   }
@@ -3251,21 +3251,21 @@ int mutt_write_fcc(const char *path, struct Email *e, const char *msgid,
   if (((WithCrypto & APPLICATION_SMIME) != 0) && post && (e->security & APPLICATION_SMIME))
   {
     fputs("X-Mutt-SMIME: ", msg->fp);
-    if (e->security & ENCRYPT)
+    if (e->security & SEC_ENCRYPT)
     {
       fputc('E', msg->fp);
       if (SmimeEncryptWith && *SmimeEncryptWith)
         fprintf(msg->fp, "C<%s>", SmimeEncryptWith);
     }
-    if (e->security & OPPENCRYPT)
+    if (e->security & SEC_OPPENCRYPT)
       fputc('O', msg->fp);
-    if (e->security & SIGN)
+    if (e->security & SEC_SIGN)
     {
       fputc('S', msg->fp);
       if (SmimeSignAs && *SmimeSignAs)
         fprintf(msg->fp, "<%s>", SmimeSignAs);
     }
-    if (e->security & INLINE)
+    if (e->security & SEC_INLINE)
       fputc('I', msg->fp);
     fputc('\n', msg->fp);
   }