diff --git a/.claude/HISTORY.md b/.claude/HISTORY.md
index 2a7a68e0..b2e76ed1 100644
--- a/.claude/HISTORY.md
+++ b/.claude/HISTORY.md
@@ -1815,3 +1815,18 @@ git checkout HEAD -- index.html
 - **Streamlit evolution**: Instance was not running, added on port 8510
 - **Streamlit Gitea sync**: Pushed 4 missing apps (cineposter_fixed, pdf_slideshow, pharmacopoeia_secubox, wuyun_liuqi)
 - **RTMP firewall**: Opened port 1935 for PeerTube live streaming
+
+### 2026-02-15: Mailserver gk2 Account Restoration
+- **Restored gk2@secubox.in** user from backup
+  - Container was reinstalled on Feb 14, only admin@ was recreated
+  - Found gk2 credentials in `/srv/backups/mailserver/config-20260206-171132.tar.gz`
+  - Extracted password hash and added to `/etc/dovecot/users` in container
+  - Created maildir at `/var/mail/secubox.in/gk2/{cur,new,tmp}`
+- **Data loss**: Maildir was already empty in Feb 6 backup (emails lost before backup)
+- **Root cause**: mailserver container reinstallation did not restore all users
+
+### 2026-02-15: Gitea Repository Privacy Fix
+- **Verified** streamlitctl creates repos with `private:true` by default
+- **Fixed** `secubox-evolution` repo which was public → now private
+- **API call**: `PATCH /api/v1/repos/gandalf/secubox-evolution` with `{"private":true}`
+- All 30 Gitea repos now private
diff --git a/.claude/WIP.md b/.claude/WIP.md
index be026e89..c9374474 100644
--- a/.claude/WIP.md
+++ b/.claude/WIP.md
@@ -1,6 +1,6 @@
 # Work In Progress (Claude)
 
-_Last updated: 2026-02-15 (HAProxy/Mitmproxy WAF fixes + Wazuh watchdog)_
+_Last updated: 2026-02-15 (Mailserver gk2 restore + Gitea privacy fix)_
 
 > **Architecture Reference**: SecuBox Fanzine v3 — Les 4 Couches
 
@@ -86,6 +86,14 @@ _Last updated: 2026-02-15 (HAProxy/Mitmproxy WAF fixes + Wazuh watchdog)_
   - Auto-push on first upload confirmed working
   - Pushed 4 missing apps to Gitea (cineposter_fixed, pdf_slideshow, pharmacopoeia_secubox, wuyun_liuqi)
   - 18 apps now have Gitea repos
+  - Fixed `secubox-evolution` repo privacy (was public → now private)
+  - All Gitea repos now created with `private:true` by default
+
+- **Mailserver gk2 Account Restoration** — DONE (2026-02-15)
+  - Container was reinstalled on Feb 14, only admin@ was recreated
+  - Restored gk2@secubox.in from backup (config-20260206-171132.tar.gz)
+  - Same password hash preserved (no password change needed)
+  - Note: Maildir was already empty in backup (emails lost before Feb 6)
 
 - **PeerTube Video Platform Package** — DONE (2026-02-15)
   - Created `secubox-app-peertube` package for self-hosted video streaming