security

// architecture

• Single Rust binary — no external runtime, no Docker, no interpreter
• All storage is local RocksDB on your filesystem
• Embeddings computed locally via ONNX Runtime (MiniLM-L6-v2, 384-dim)
• Entity extraction runs locally via a bundled NER model
• No network calls are made during normal operation
• The only network activity is model downloads on first run (from HuggingFace, with checksum verification)

// data isolation

• Each user gets a separate storage directory with isolated RocksDB instances
• Multi-user mode uses per-user column families — no cross-user data access
• API endpoints are scoped by user ID — one user cannot access another's memories
• The MCP server runs on localhost by default — not exposed to the network

// network exposure

• The REST API binds to 127.0.0.1:3030 by default (localhost only)
• WebSocket endpoint (/api/stream) has no authentication — acceptable for localhost, not recommended for network exposure
• If you expose the API to a network, use a reverse proxy with authentication (nginx, Caddy, etc.)
• The MCP server communicates over stdio — no network sockets involved

// supply chain

• Model URLs are pinned to immutable HuggingFace commits
• All model downloads are verified with SHA-256 checksums
• Binary releases are built via GitHub Actions CI with reproducible builds
• Dependencies are audited — see cargo audit in CI
• Published on crates.io, npm, and PyPI with standard package verification

// memory safety

• Core written in Rust — memory-safe by design, no buffer overflows or use-after-free
• 1089 tests covering storage, retrieval, graph operations, and edge cases
• CI runs cargo clippy with strict warnings on every PR
• OOM protection: deserialization has 10MB size limits to prevent allocation attacks
• ONNX Runtime configured with thread limits and lock timeouts to prevent deadlocks

// backup & recovery

• Built-in backup system with SHA-256 checksum verification
• Backups cover all data: memories, todos, reminders, facts, knowledge graph, feedback, audit logs
• Point-in-time restore with integrity verification before restore
• Backup purging to manage disk space (configurable retention count)

// responsible disclosure

If you discover a security vulnerability, please report it responsibly:

• Email: enterprise@shodh-memory.com with subject "SECURITY"
• Do not open a public GitHub issue for security vulnerabilities
• We will acknowledge receipt within 48 hours
• We will provide a fix timeline within 7 days
• We credit all responsible disclosures (unless you prefer anonymity)