@takk/mnemosyne is a stable (1.0.0) library that gives Massive Intelligence (IM) agents persistent, portable, shared memory over a pluggable store, with a deterministic 256-dimensional identity, field-level masking and residency, and Ed25519-signed, SHA-256-chained tamper-evident access logs. We take security reports seriously and aim to acknowledge each one within two business days.

Each published version follows strict SemVer (see SPEC.md and .github/RELEASING.md). Only the latest minor of the current major receives security patches; an older major receives critical-CVE fixes for 6 months after the next major lands.

Please do not file public GitHub issues for security problems. Send reports to davcavalcante@proton.me (preferred) or say@takk.ag (Takk relay), with the subject line beginning [SECURITY].

Include, at minimum:

• Affected version (npm ls @takk/mnemosyne).
• Reproduction steps or a minimal proof-of-concept.
• Impact assessment (what an attacker can achieve).
• Any suggested mitigation.

If your report involves a vulnerability in a third-party peer dependency, please also link the upstream advisory (CVE, GHSA, etc.) so we can coordinate the disclosure.

PGP / signed reports are welcome but not required. If you need an out-of-band channel, ask in the first message and we will propose one.

1. Acknowledgement within 2 business days.
2. Triage and severity assignment within 7 days.
3. Fix targeted for the next release; critical issues ship as an out-of-band patch on the affected minor.
4. Coordinated disclosure: the reporter is credited in the changelog and advisory unless they request anonymity.

Findings in any of the following are in scope:

• Identity integrity. Any way to make the deterministic 256-dimensional identity derivation produce a different vector for the same input, drift across model swaps it is meant to survive, or leak the source material it was derived from, or any non-determinism that breaks reproducibility of the identity.
• Audit integrity. Any way to make verifyChain return valid: true for a log that was altered after sealing, any hash-chain construction that lets a forged entry pass, any way to defeat the SHA-256 chaining, or any way to forge or strip an Ed25519 signature so a tampered access record verifies as authentic.
• Masking and residency. Any way to make the masking pipeline (redact, hash, partial) emit an unmasked value, leak a field tagged for redaction, or let a record cross a residency boundary it was tagged to stay within, or any path that writes sensitive memory to a store before masking is applied.
• Store and adapter input. Any way to make a store adapter read or write outside the keyspace it was given, mutate memory from attacker-supplied input in a way the host did not authorise, or any malformed record that bypasses validation and yields prototype pollution or an unbounded read or write.
• Loaders and snapshots. Path traversal or any way to make the file-backed store in @takk/mnemosyne/node read or write outside the path you pass it, or any malicious memory file or snapshot that bypasses validation and yields a malformed record, prototype pollution, or corrupted memory state.
• Supply chain. Tarball contamination, compromised npm scope, or a published artifact whose provenance attestation does not match the source commit.

• The security or correctness of the store you provide. Mnemosyne persists memory into the store you inject (in-memory, edge key-value, or a Node file on your disk); the safety of that store, its access controls, and its backing medium is your concern.
• The content of memory you write. Mnemosyne stores what you give it; it does not sanitize, validate, or defend against adversarial content an agent places into memory. Prompt-injection resistance of the agents that read and write memory is an application concern.
• The sensitivity classification you choose. If you do not tag a field for masking or a record for residency, Mnemosyne stores it as given; the policy is yours to set.
• Exposure caused by a misconfiguration that disables masking, residency, or the access log. Those guards are yours to enable.
• Theoretical attacks against the cryptographic primitives used for the access log (Ed25519, SHA-256) and the Web Crypto implementation of the host runtime; report those upstream.

• Zero required runtime dependencies. The attack surface from transitive dependencies is eliminated. Every @takk sibling is an optional peer dependency you install explicitly.
• Node-free core. The core never makes a network call, and all cryptography uses the Web Crypto API (globalThis.crypto.subtle) rather than node:crypto. Only the optional @takk/mnemosyne/node file-backed store touches the Node standard library, and it only reads and writes the files you point it at.
• Provenance. Every release is published with npm publish --provenance (SLSA attestation by GitHub Actions). Verify with npm view @takk/mnemosyne@<version> --json | jq .dist.attestations.
• Lockfile committed. pnpm-lock.yaml is tracked in git for reproducible installs.