Hi Graham.

A Huge thank you.
I haven't tested anything yet but to answer some of your thoughts:

there will only be one type of attachment and only the same password.
i just created a rule saying from this sender, while having attachment .
basically the sender & attachment is the same and rule will only apply to that specific rule set.

only thing I wish is that it wasn't client side:-/
i look forward to testing your code on Monday!