| Secrets end up in memory |
Redaction runs before anything is stored. It covers title, content, sourceRef and tags, on save, update and import, and runs again on MCP output. Recognized formats include AWS keys, GitHub/GitLab/Slack/Stripe/npm/PyPI tokens, OpenAI/Anthropic/Google API keys, JWTs, PEM private keys, bearer tokens, credentials in URLs and password=-style assignments. DEVMEMORY_SECRET_POLICY=reject refuses the write instead of redacting it. |
| Prompt injection through stored memories |
Memory text is never executed. Context bundles are wrapped in an envelope that says the content is untrusted data, and stored text cannot close the envelope's delimiters. Instruction-like text is flagged (instructionLike, with a warning= attribute in bundles). The MCP tool descriptions repeat that memories are data, not instructions. |
| Data leaking across projects |
Each MCP server is bound to one project when it starts, and no tool accepts a project id. Every query is filtered by project_id. Other projects' ids return NOT_FOUND, and tests cover every read and write path. |
| A cloned repo claiming another project's identity |
Project identity is the canonical directory path, stored only in your local database. Nothing is written into the repository. |
| Path traversal and symlink attacks on import/export |
Paths must stay inside the current directory unless you pass --allow-outside-cwd. Files are opened with O_NOFOLLOW and parent directories are checked with realpath. Exports refuse to overwrite existing files without --force and are written with mode 0600. Imports must be at most 10 MB and 10,000 memories. |
| SQL injection |
All SQL is parameterized. User text never reaches FTS5 operators: every search term is quoted. |
| Malicious imports |
The whole file is validated with Zod and imported in a single transaction, so an error imports nothing. Ids are always reissued, and content is redacted again on import. |
| Database corruption or schema downgrade |
Corrupt files fail with DB_CORRUPT. Opening a database from a newer version fails with DB_VERSION_UNSUPPORTED. A backup is made before each migration. devmemory doctor checks integrity. |
| Deleted text left on disk |
secure_delete=ON, an FTS optimize after deletes, and a WAL checkpoint. |
| Exposure over the network |
There is no network listener and no telemetry. Transport is stdio only. |