Memora Core is pre-1.0. Security fixes are applied to:

Once we cut v1.0, the LTS branch (every 4th minor — see PRD #297 §10) gets a 12-month security-fix window.

Do NOT open public GitHub issues for security findings.

Email security@axiomstudio.ai with:

• A description of the vulnerability.
• Steps to reproduce, including any required configuration.
• An assessment of the impact (data loss, RCE, privilege escalation, denial of service, information disclosure).
• Optional: proposed remediation or proof-of-concept.

We aim to respond within 3 business days with an acknowledgement and a remediation timeline.

• Reports are triaged by the Memora maintainers.
• We aim to ship a fix in 30 days for high-severity findings, 60 days for medium, 90 days for low — measured from triage to released fix on main.
• Once a fix is released, we publish a GitHub Security Advisory with details and CVE assignment when applicable.
• Reporters are credited in the advisory unless they request anonymity.

• The memora-core server binary and its adapters.
• The memora-cli binary.
• The bundled MCP server.
• Schema migrations.
• CI workflows and release artifacts (binaries, Docker image, Helm chart).

Memora considers security research conducted in good faith and within the In-scope boundary above to be authorized activity, and will not pursue or support legal action against researchers who:

• Make a good-faith effort to avoid privacy violations, data destruction, service degradation, and disruption to non-test infrastructure.
• Use the reporting channel above and avoid public disclosure until the remediation timeline in the Disclosure process section is met (or a 90-day default elapses, whichever is sooner).
• Do not exfiltrate more data than is necessary to demonstrate the issue, and securely delete any retained copies after the report is acknowledged.

This authorization is limited to the In-scope artifacts above and does not extend to third-party adapters, operator deployments, or any system not controlled by the Memora project. Reference: ISO/IEC 29147, disclose.io template (CC0).

• Third-party adapter implementations (report to the adapter author).
• Deployment misconfigurations on the operator's end (multi-tenant flag misuse, exposed admin keys, weak TLS settings — these are documented in the Operations guide).
• DoS against an unauthenticated endpoint when authentication is required by spec.
• Findings in pre-release / unreleased code that ships within 7 days of the report (we'll already fix it in the release).

If you prefer to encrypt your report, our PGP key is published at https://axiomstudio.ai/.well-known/pgp-key.asc (placeholder — final key gets published with v0.1).