# Security

## Reporting Vulnerabilities

**DO NOT** open public issues for security vulnerabilities.

Use GitHub's **Private Vulnerability Reporting** feature:

1. Go to the [Security tab](https://github.com/simplemindedbot/mnemex/security)
2. Click **"Report a vulnerability"**
3. Fill out the advisory form with details

Expected response time: **48 hours**

## Security Measures

### Automated Scanning

Mnemex uses multiple security scanning tools:

- **Dependabot**: Automated dependency updates
- **pip-audit**: Official PyPA vulnerability scanner
- **Bandit**: Python security linter
- **CodeQL**: Semantic code analysis

Scans run:
- On every push/PR
- Weekly scheduled scans (Mondays 10:00 UTC)
- Manual workflow dispatch

### Supply Chain Security

- Dependencies tracked with Dependabot
- Auto-merge for safe updates (patch/minor dev dependencies)
- All dependencies from trusted sources (PyPI)

### Local-First Privacy

🔒 **All data stored locally** - no cloud services, no tracking, no data sharing.

- Short-term memory: `~/.config/mnemex/jsonl/` (JSONL format)
- Long-term memory: Your Obsidian vault (Markdown)
- Configuration: `~/.config/mnemex/.env`

### File Permissions

Sensitive files use restrictive permissions:

```python
# Config files: rw------- (0o600)
os.chmod(config_file, 0o600)

# Storage directories: rwx------ (0o700)
os.chmod(storage_dir, 0o700)
```

### Input Validation

All user inputs validated:

- Memory IDs checked for format
- File paths validated (no traversal)
- Tags/entities sanitized
- Content size limits enforced

## Best Practices

### Configuration Security

1. **Never commit `.env` files** to version control
2. **Use restrictive permissions** on config files
3. **Review configuration** before sharing

### Storage Security

1. **Regular backups** - Git integration available
2. **Encrypt disk** for additional protection
3. **Review stored data** periodically

### Integration Security

1. **MCP server** runs locally (no network access)
2. **Claude Desktop** controls access to tools
3. **No external API calls** without explicit config

## Security Roadmap

Ongoing improvements tracked in [Issue #6](https://github.com/simplemindedbot/mnemex/issues/6):

- [ ] SBOM (Software Bill of Materials) generation
- [ ] Dependency pinning with hashes
- [ ] Runtime security audits
- [ ] Additional input validation
- [ ] Path traversal prevention hardening

## Disclosure Policy

When you report a vulnerability:

1. **Acknowledgment**: Within 48 hours
2. **Assessment**: Within 7 days
3. **Fix timeline**: Depends on severity
   - Critical: 24-48 hours
   - High: 7 days
   - Medium: 30 days
   - Low: Next release
4. **Coordinated disclosure**: Work with reporter on timing

## Security Contact

Use GitHub's private reporting feature (link above).

## Security Updates

Subscribe to:
- [GitHub Security Advisories](https://github.com/simplemindedbot/mnemex/security/advisories)
- [Release notifications](https://github.com/simplemindedbot/mnemex/releases)

## License

Security practices follow OWASP guidelines and OSSF best practices.

See also:
- [SECURITY.md](https://github.com/simplemindedbot/mnemex/blob/main/SECURITY.md) (main policy)
- [Contributing guidelines](CONTRIBUTING.md)
