Do NOT open public issues for security vulnerabilities.

Email: [email protected]

Include:

• Description of the vulnerability
• Steps to reproduce
• Impact assessment
• Suggested fix (if any)

We will respond within 48 hours and provide a fix timeline within 7 days.

• The core store/recall path can run locally at the configured SLM data root (default: ~/.superlocalmemory/)
• The local core has no telemetry, analytics, or phone-home behavior
• Configured remote embedding, remote reranking, connectors, cloud backups, or model downloads can make network calls during store/recall or related jobs; assess those explicit choices before treating an installation as local-only
• SQLite with WAL mode for data integrity

Personal installs (require_login = false): loopback owner is trusted without a session cookie. The install token is carried as a personal/API-token header (X-SLM-Install-Token / Authorization: Bearer …) and compared with HMAC-SHA256 timing-safe comparison. Rate limiting: 30 writes/min, 120 reads/min.

Enterprise installs (require_login = true): the dashboard login flow issues an HttpOnly session cookie (slm_session; add Secure with SLM_DASHBOARD_HTTPS=1). Mutations require CSRF and origin controls in addition to the session: Origin must match the daemon, Sec-Fetch-Site is checked, and OAuth initiation is same-origin gated (src/superlocalmemory/server/routes/backup.py, server/origin.py, server/rbac_enforce.py). See docs/rbac-teams.md.

• Parameterized SQL queries throughout (no SQL injection)
• XSS protection via escapeHtml() in all UI rendering
• Security headers: X-Frame-Options, CSP, X-Content-Type-Options
• CORS whitelist with credential control
• Secret/PII redaction before persistence and before the remote-reranker trust boundary ( src/superlocalmemory/retrieval/remote_reranker.py: redact_secrets + redact_pii_text as best-effort, not DLP); remote reranker responses are bounded (8 MiB), redirects are not followed, and malformed values suppress bodies without logging them. Remote embedding (core/embeddings.py _openai_compatible_embed_batch) sends raw input text with optional Bearer and does not apply the remote-reranker HTTPS/non-loopback, userinfo/query/fragment rejections or body-suppression — scope SSRF claims to the reranker path.

SuperLocalMemory loads local embedding, reranker, and compression models via Hugging Face. Two risks apply:

• trust_remote_code: since v3.7.9, trust_remote_code=True is passed only for an internal allowlist of pinned models (the nomic-embed family, which requires custom modeling code). Any other model — including one swapped into config through a write path — loads with trust_remote_code=False and cannot execute repository code at load time.
• CVE-2025-14926 (transformers, SEW tokenizer): arbitrary code execution when loading a crafted SEW tokenizer config. No upstream patch exists as of 2026-07-20. SLM never loads checkpoints automatically; it will be upgraded as soon as a patch ships.

Only install models from sources you trust. A malicious checkpoint can execute code under your user account at load time regardless of these mitigations.

• Production backups are independent per-file sqlite3.backup() snapshots via BackupManager (not a coherent cross-store epoch); companion failures are non-critical. The coherent BackupCoordinator exists as a primitive but is not wired to production/routes. Dashboard Export is memory.db-only gz.
• Legacy backup destination follows process umask, not source-file modes; place backups on an encrypted/private volume and verify 0600/0700.
• Stop the daemon (slm serve stop) before offline whole-root copy/restore so WAL/SHM checkpoint; include sidecars and lance/ if present.
• Credentials: OS keychain preferred (macOS Keychain / Windows Credential Locker / Linux Secret Service); fallback is owner-only plaintext ~/.superlocalmemory/.credentials.json (0600, 0700 parent, atomic write). Provider/reranker keys persisted in config.json are plaintext protected only by atomic 0600; prefer env (OPENAI_API_KEY, SLM_CROSS_ENCODER_API_KEY) to avoid disk persistence.
• Feedback pseudonym: per-install keyed HMAC producing a 16-hex (64-bit) query_hash ( learning/feedback.py: _hash_query ), not encryption; within-install correlation is possible, key is 0600 beside the DB (.feedback-hash-key, 32 bytes). Read-only data root falls back to a process-local key, losing cross-restart grouping.

• M038_learning_feedback_channel (eager) and M039_scene_fact_members (deferred, after engine tables exist) are automatically applied at startup; no manual slm db migrate is normally required. slm db migrate is forward-only (status/--dry-run/apply) — no rollback. Downgrade requires a verified pre-upgrade complete backup (stop daemon, whole-root copy).

• GDPR Article 15 (right to access): full data export
• GDPR Article 17 (right to erasure): complete erasure including learning data
• EU AI Act data sovereignty: assess the configured deployment and egress path; Mode A's local core alone is not a legal or network-locality guarantee
• Tamper-proof audit trail with SHA-256 hash chain
• Bounded / content-free diagnostics export: slm diagnostics export

Run npm audit and pip audit regularly. Report any findings.

The SLM architecture is documented in three public arXiv preprints authored by Varun Pratap Bhardwaj (Qualixar) — these have not undergone external venue review:

• Paper 1 (arXiv:2603.02240): Bayesian trust defense, OWASP-aligned memory poisoning protection
• Paper 2 (arXiv:2603.14588): Information-geometric foundations, cellular sheaf cohomology for contradiction detection
• Paper 3 (arXiv:2604.04514): Trust-weighted forgetting, compliance audit trails, FRQAD mixed-precision integrity

Supporting external work cited by SLM (for example, venues such as ICLR 2026 and Nature Scientific Reports referenced in ATTRIBUTION.md and LLD-03/LLD-04) is distinct from the three SLM preprints and should be evaluated against its own venue review.

Part of Qualixar | Author: Varun Pratap Bhardwaj