If you discover a security vulnerability in MemoryHub, please report it responsibly.

1. DO NOT open a public GitHub issue for security vulnerabilities
2. Email: security@memoryhub.dev (or create a private security advisory on GitHub)
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• 24 hours: Initial acknowledgment
• 72 hours: Preliminary assessment
• 7 days: Fix or mitigation plan
• 30 days: Public disclosure (coordinated)

MemoryHub includes several security features:

• API key-based authentication for all memory operations
• Keys are hashed (SHA-256) before storage
• Keys shown only once at creation time
• Revocation support for compromised keys

• Automatic detection of API keys, passwords, tokens, private keys
• Detection patterns for AWS keys, OpenAI keys, SSH keys, database URLs
• Optional auto-redaction before storage
• Configurable via MEMORYHUB_ENABLE_SENSITIVE_DETECTION

• Agents can only access memories in their own namespace
• No cross-namespace data leakage
• Separate API keys per agent

• SQLite WAL mode for crash safety
• Configurable token expiration
• No sensitive data in logs by default

• Default SQLite storage is single-machine only
• API keys use SHA-256 (not bcrypt) for performance; use strong keys
• CORS allows all origins by default in development
• Embeddings model downloads from Hugging Face on first run

1. Always set a strong secret key: MEMORYHUB_SECRET_KEY=$(openssl rand -hex 32)
2. Use HTTPS in production (reverse proxy with TLS)
3. Restrict CORS to your domains only
4. Regular backups of the database file
5. Monitor API usage for unusual patterns
6. Use PostgreSQL for production multi-instance deployments
7. Keep dependencies updated: pip install --upgrade memoryhub