Mod_security protects against problematic applications, bots, application vulnerabilities, and the like. Since Redmine Mailhandler doesn't have a user-agent, it also gets rejected by the default rules. As the Redmine repository manager already has a user-agent, it would be proper to also add one here for clarification of 'what' is sending a POST to /mail_handler (even though we both know what it is). Maybe something similar to the Redmine repository manager's user-agent, "Redmine Mail Handler/#{version}" or "Redmine Mailhandler/#{version}" :)