If you discover a security vulnerability in mneme, please do not open a public GitHub issue. Instead, report it privately via one of the following channels:
- GitHub Security Advisories at https://github.com/OnourImpram/mneme/security/advisories/new
- Email: onuribram@outlook.com (put "mneme security" in the subject line)
Please include:
- A description of the vulnerability and its potential impact.
- Steps to reproduce the issue.
- Any proof-of-concept code or screenshots.
- Your name and affiliation if you would like public credit after the fix is published.
mneme currently has a single maintainer; the targets below are honest best-effort commitments, not a staffed SLA.
- Acknowledgment within 48 hours.
- Initial assessment within 7 days.
- Fix release target depending on severity.
- Critical: 7 days.
- High: 14 days.
- Medium: 30 days.
- Low: next scheduled release.
Only the latest minor release of mneme receives security patches. Older versions should upgrade.
On Windows, the HMAC audit key (<stateDir>/audit-hmac.key) is created without NTFS ACL restrictions because Node.js fs.openSync mode bits have no effect on NTFS. Operators must manually restrict the state directory: icacls "<stateDir>" /inheritance:r /grant:r "%USERNAME%:(OI)(CI)F". Full icacls automation is planned for a future release.
- Third-party dependencies (please report upstream).
- Self-hosted Neo4j or LEANN runtime issues unless triggered by mneme code.
- Vulnerabilities in user-supplied vault content.
- Issues that require physical access to the machine running mneme.
Coordinated disclosure: we will work with you on a public disclosure date once a fix is available. Default window is 90 days from initial report. Credit will be given in CHANGELOG.md and the GitHub Security Advisory unless you request anonymity.