@modusensus/dsh-mneme 0.7.3 → 0.7.5

package/SECURITY.md

@@ -0,0 +1,674 @@
+# Security Policy
+
+> **English** | [中文](#安全策略)
+
+---
+
+## Supported Versions
+
+We actively maintain the latest minor version. Security fixes are backported to the latest patch release, and critical fixes may be backported to the previous minor version.
+
+| Version | Supported | Status |
+|---|---|---|
+| 0.7.x | ✅ Yes | Active development |
+| 0.6.x | ⚠️ Best-effort | Critical fixes only |
+| < 0.6.0 | ❌ No | Please upgrade to 0.7.x |
+
+**End-of-life notice**: 0.6.x is in best-effort maintenance (critical fixes only). Its end-of-life date will be announced in advance; after that date no security fixes will be provided for 0.6.x.
+
+---
+
+## Known Security Features
+
+The following security features are implemented and maintained in the project:
+
+| Feature | Description | Status |
+|---|---|---|
+| `apiToken` Authentication | All remote endpoints require `Authorization: Bearer <apiToken>` when a token is configured; comparison uses `crypto.timingSafeEqual` | ✅ Implemented |
+| `policyEpoch` Memory Governance | Bumping `policyEpoch` downgrades all prior `dream_runs` to historical evidence; their receipts no longer drive real-time memory decisions | ✅ Implemented |
+| `conflictFreezeEnabled` Conflict Freeze | Conflicting memories are not auto-merged; they are flagged as pending human review, preserving data integrity | ✅ Implemented |
+| CAS (Compare-and-Swap) Guard | Prevents concurrent write conflicts; ensures atomic write operations | ✅ Implemented |
+| Digest Baseline Audit | Memory updates are compared against digest baselines to detect unauthorized changes | ✅ Implemented |
+| `failure_memories` Audit Trail | Every failed write operation is logged for forensic analysis | ✅ Implemented |
+| `recall_run` Search Audit | Every search operation is recorded with timestamp and query metadata | ✅ Implemented |
+| Local-First Data Processing | All embeddings, reranking, and memory consolidation run locally; no data leaves the device | ✅ Implemented |
+| No Telemetry | No analytics, no remote logging, no network requests by design | ✅ Implemented |
+| Query Sanitization | LIKE-query escaping, bounded paging, and Markdown mirror escaping prevent injection and malformed input | ✅ Implemented |
+| `entityExtractionEnabled` Opt-In Entity Extraction | Entity extraction is opt-in via configuration (default: off), minimizing data processing by default | ✅ Implemented |
+| Graceful Degradation | System falls back to keyword search on component failure; no crash | ✅ Implemented |
+| Human-Editable Mirrors | All memories mirrored to Markdown files; users can verify and reconstruct data | ✅ Implemented |
+| Mirror Generation CAS/Fence | Mirror sync is bound to a monotonic `generation` counter with CAS/fence semantics; stale or concurrent mirror writes are rejected | ✅ Implemented |
+| Crash-Recovery Debt Model | Business writes atomically bump `desired generation` in the same transaction; after a crash, `recoverMirror` replays the debt instead of silently skipping repairs | ✅ Implemented |
+| `/health` Auth-Gated Endpoint | Health endpoint requires `apiToken`; error codes are sanitized (no-space / permission / sync-failed) and read failures fail closed as `unknown` | ✅ Implemented |
+| Fail-Closed Input Validation | Generation counters and hot-memory parameters are validated (`Number.isInteger`, finite, non-negative) with SQL `CHECK` constraints; invalid input falls back to safe defaults or is rejected | ✅ Implemented |
+| Hybrid Score Clamping | Hybrid fusion scores are clamped to [0, 1] to prevent vector + BM25 stacking from breaking normalization bounds | ✅ Implemented |
+| Tag Sanitization | Tag normalization reuses the sanitizer; `autoTag` skips forgotten memories; `setMemoryTags` runs inside a SAVEPOINT for atomic rollback | ✅ Implemented |
+
+---
+
+## Reporting a Vulnerability
+
+### Please DO NOT
+
+- Open a public issue for security vulnerabilities
+- Post exploit details in discussions or comments
+- Submit PRs that expose security flaws without prior coordination
+
+### Please DO
+
+1. **Email** `guanqishi26@gmail.com` (or open a **private security advisory** via [GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories))
+2. Include:
+   - A clear description of the vulnerability
+   - Steps to reproduce (minimal test case preferred)
+   - Impact assessment (data exposure? local-only? remote?)
+   - Affected versions
+   - Your proposed fix (if any)
+   - Whether you are requesting credit / disclosure preferences
+
+### Response Timeline
+
+| Phase | Time | Action |
+|---|---|---|
+| Acknowledgment | Within 48 hours | We confirm receipt and assign a tracking ID |
+| Initial Assessment | Within 7 days | We validate severity and scope; we may request additional information |
+| Fix Development | Severity-dependent | Critical: ≤ 14 days; High: ≤ 30 days; Medium/Low: next release |
+| Validation & Testing | 1–3 days after fix | We run regression and security tests on the patch |
+| Coordinated Disclosure | At fix release | We publish a security advisory and release patch simultaneously |
+
+**Note**: For Critical vulnerabilities, if a full fix cannot be developed within 14 days, we will provide a temporary mitigation or workaround within that timeframe.
+
+### Severity Classification
+
+We follow the [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document) standard:
+
+- **Critical** (9.0–10.0): Remote code execution, unauthorized data exfiltration, bypass of core security controls
+- **High** (7.0–8.9): Local privilege escalation, significant data integrity compromise, DoS with high impact
+- **Medium** (4.0–6.9): Information disclosure under specific conditions, partial bypass of controls
+- **Low** (0.1–3.9): Minor information leakage, defense-in-depth improvements
+
+---
+
+## Security Design Principles
+
+### 1. Local-First, Zero-Network
+
+- All embeddings, reranking, and memory consolidation run locally
+- Memory text **never** leaves the device
+- No telemetry, no analytics, no remote logging
+
+### 2. Fail-Safe by Default
+
+- Any component failure (LLM, embedder, reranker) degrades gracefully to keyword search
+- Malformed input never crashes the plugin or corrupts the database
+- Concurrent write conflicts are resolved via CAS (compare-and-swap) guards
+
+### 3. Audit Everything
+
+- Every `autoDream` run generates a cryptographically verifiable receipt
+- Every memory update creates a `failure_memories` audit trail
+- Every search records a `recall_run` for later inspection
+
+### 4. Human Sovereignty
+
+- All memories are mirrored to human-editable Markdown files
+- Machine writes vs. human edits are distinguished via digest baselines
+- Users can fully reconstruct the database from Markdown mirrors alone
+
+### 5. Minimal Remote Surface
+
+- Remote API endpoints are opt-in: they require a configured `apiToken`
+- When a token is set, every remote request is checked with a timing-safe comparison
+- When no token is set, remote endpoints are effectively disabled; all processing stays local
+
+---
+
+## Dependency Vulnerability Handling
+
+### Process
+
+We follow a 5-step process for handling third-party dependency vulnerabilities:
+
+| Step | Action | Timeframe | Tooling |
+|---|---|---|---|
+| 1. Scan | Continuous automated scanning of all runtime and development dependencies | Automated (daily) | OrbisAI Security, npm audit |
+| 2. Assess | For each detected vulnerability, assess severity, exploitability, and impact on dsh-mneme | Within 48 hours of detection | CVSS v3.1, manual code analysis |
+| 3. Report | Document findings in the security tracker; report to maintainers | Immediately after assessment | Security tracker, maintainer channel |
+| 4. Fix | Upgrade dependency to a patched version or apply mitigation | Critical: ≤ 14 days; High: ≤ 30 days; Medium/Low: next release | npm/pnpm update, manual patching |
+| 5. Disclose | Publish security advisory with details and fixed version | At release of fixed version | GitHub Security Advisories + npm release notes |
+
+### Third-Party Dependency Policy
+
+- All new runtime dependencies must pass a security review before inclusion
+- Dependencies with known critical vulnerabilities that cannot be fixed within the timeline will be replaced with alternatives
+- Dependency lockfiles (`package-lock.json`) are committed and reviewed in PRs
+
+### Recent Dependency Fixes
+
+| CVE | Package | Version (Before) | Version (After) | Severity | Fixed In |
+|---|---|---|---|---|---|
+| CVE-2026-39244 | `adm-zip` | 0.5.18 | 0.6.0 | High | v0.3.4 |
+
+---
+
+## Security Audit History
+
+### v0.2.10 — Security Hardening
+
+| ID | Finding | Severity | Status |
+|---|---|---|---|
+| F-NEW-01 | Concurrent write race on `store.js` | **Critical** | ✅ Fixed (CAS guard + atomic write) |
+| F-NEW-02 | Transactional inconsistency during mirror sync | **High** | ✅ Fixed (transactional mirror + rollback) |
+| F-NEW-03 | Mirror health state not validated before overwrite | **High** | ✅ Fixed (digest baseline + FSM validation) |
+
+### v0.3.4 — Dependency Security
+
+| CVE | Package | Severity | Status |
+|---|---|---|---|
+| CVE-2026-39244 | `adm-zip` 0.5.18 | **High** | ✅ Fixed (upgraded to 0.6.0) |
+
+### v0.3.6 — Mirror Debt Modeling (audit peer re-verification)
+
+| Finding | Severity | Status |
+|---|---|---|
+| Mirror sync not bound to a generation counter (stale overwrite window) | **High** | ✅ Fixed (generation + CAS/fence semantics, per-type status) |
+| `/health` endpoint unauthenticated with verbose error codes | **High** | ✅ Fixed (auth-gated, sanitized codes, fail-closed `unknown`) |
+| COMMIT-crash window could permanently skip mirror repairs | **High** | ✅ Fixed (recoverMirror triggers on dirty OR generation > applied) |
+
+### v0.3.8 — Mirror Sync Reliability (peer 6 blockers)
+
+| Finding | Severity | Status |
+|---|---|---|
+| Silent mirror sync failures (no error surfaced to write path) | **High** | ✅ Fixed (`syncMirror` returns `{success, error}`; `afterSync` check on write entry) |
+| Non-atomic generation increments under multi-process concurrency | **High** | ✅ Fixed (`UPDATE ... RETURNING` atomic statement + `PRAGMA busy_timeout=5000`) |
+| Generation counter overflow / negative values | **Medium** | ✅ Fixed (JS validation + SQL `CHECK(0..MAX_SAFE_INTEGER)`) |
+
+### v0.3.9 — Audit A/B/D/F
+
+| Finding | Severity | Status |
+|---|---|---|
+| CAS update and generation increment not in the same transaction | **High** | ✅ Fixed (atomic `runAtomically`; miss does not increment) |
+| Failed updates could report success | **High** | ✅ Fixed (degraded/pending receipts with mirror attributes) |
+| Generation validation not fail-closed | **Medium** | ✅ Fixed (`Number.isInteger` fail-closed + migration detects stale dirty values) |
+
+### v0.5.1 — Hot Memory Parameter Defense
+
+| Finding | Severity | Status |
+|---|---|---|
+| Negative / non-finite `maxRounds`/`maxTokens` could trigger a synchronous infinite loop via public API | **High** | ✅ Fixed (fallback to safe defaults 5/2000) |
+| Hybrid fusion score could exceed 1.0 (vector + BM25 stacking) | **Medium** | ✅ Fixed (clamp to [0, 1]) |
+
+### v0.6.5 — Tag System Hardening
+
+| Finding | Severity | Status |
+|---|---|---|
+| `autoTag` could tag forgotten memories | **Medium** | ✅ Fixed (filter `forgotten` before tagging) |
+| Tag normalization bypassed the sanitizer | **Medium** | ✅ Fixed (reuse `sanitize` in `normalizeTags`) |
+| `setMemoryTags` not atomic on failure | **Medium** | ✅ Fixed (SAVEPOINT rollback) |
+
+### Ongoing
+
+- Automated dependency scanning via **OrbisAI Security**
+- Community security reviews welcome via private advisory
+
+---
+
+## Security Advisory Channels
+
+Security advisories are published through the following channels simultaneously:
+
+1. **[GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories)** — primary channel with detailed technical information
+2. **[npm Releases](https://www.npmjs.com/package/@modusensus/dsh-mneme)** — release notes include security advisories and fix summaries
+
+To receive security notifications:
+- **GitHub**: Watch the repository and enable "Security alerts" in repository settings
+- **npm**: Subscribe to package release notifications for `@modusensus/dsh-mneme`
+
+---
+
+## Disclosure Policy
+
+We practice **coordinated disclosure**:
+
+1. Reporter submits vulnerability privately
+2. We investigate and acknowledge within 48 hours
+3. We develop fix and prepare advisory (timeline based on severity)
+4. We notify reporter of fix timeline and planned disclosure date
+5. We release patch + publish advisory simultaneously
+6. We credit the reporter (with their consent) in the advisory
+
+We do **not** pursue legal action against security researchers who:
+- Act in good faith
+- Do not exploit vulnerabilities beyond proof-of-concept
+- Do not access data belonging to others
+- Allow reasonable time for us to respond before public disclosure
+
+**Bug Bounty Policy**: This project does not currently offer monetary rewards. We provide public credit in the advisory (with the reporter's consent).
+
+---
+
+## Security Logs & Data Retention
+
+All audit data is stored **locally** in the plugin database and never leaves the device:
+
+| Data Type | Storage Location | Notes |
+|---|---|---|
+| `failure_memories` audit logs | Local database | Every failed write is recorded; used for forensic analysis |
+| `recall_run` search logs | Local database | Every search is recorded with timestamp and query metadata |
+| AutoDream receipts | Local database + Markdown mirror | Cryptographically verifiable; persist until user deletes them |
+| Dependency scan reports | OrbisAI Security dashboard | Not stored on device |
+
+Retention is user-controlled: audit records live only as long as the local database does. There is no remote logging and no telemetry.
+
+---
+
+## Security-Related Configuration
+
+```yaml
+# Hardened configuration example (all keys below match src/config.js where applicable)
+dsh-mneme:
+  # Disable autoDream if you want full manual control
+  autoDream: false
+
+  # Enable conflict freeze for sensitive environments
+  conflictFreezeEnabled: true
+
+  # Use local-only embedding (no network)
+  embedProvider: local
+
+  # Require Authorization: Bearer <apiToken> on remote endpoints (timing-safe)
+  apiToken: "set-a-strong-unique-token"
+
+  # Bump to downgrade all prior dream_runs to historical evidence
+  policyEpoch: 1
+
+  # Keep entity extraction off by default (data minimization)
+  entityExtractionEnabled: false
+
+  # Reranking is opt-in (default: off) — no extra model downloads unless enabled
+  rerankEnabled: false
+
+  # Keep auto-tagging off by default (data minimization)
+  autoTagEnabled: false
+
+  # Disable session lifecycle if you do not need session-scoped disposal
+  sessionLifecycleEnabled: false
+
+  # Disable sleep mode maintenance if you want zero background activity
+  sleepModeEnabled: false
+
+  # Epistemic trust weighting is opt-in (default: off)
+  trustEpistemicWeighting: false
+
+  # LLM audit log retention (days)
+  llmAudit:
+    enabled: true
+    retentionDays: 90
+```
+
+---
+
+## Contributor Security Guidelines
+
+All contributors must comply with the following security requirements:
+
+1. **Dependency Audit**: Run `npm audit` before submitting a PR; newly introduced dependencies must pass security review
+2. **Secret Scanning**: Never commit API keys, tokens, or credentials to the repository
+3. **Input Validation**: All user inputs must be validated and sanitized (including LLM-derived content)
+4. **Secure Code Review**: PRs with security-relevant changes require approval from a maintainer with security expertise
+5. **Documentation**: New features must include a security impact analysis in the PR description
+6. **Responsible Disclosure**: Security vulnerabilities found during development must be reported via the appropriate channel, not in public PRs
+
+---
+
+## Contact
+
+- **Security Team**: `guanqishi26@gmail.com`
+- **Private Advisory**: [GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories)
+- **GPG Key**: Available upon request for encrypted communication
+
+---
+
+## License
+
+This project is licensed under the **MIT License**. See [LICENSE](https://github.com/modusensus/dsh-mneme/blob/main/LICENSE) for details.
+
+---
+
+# 安全策略
+
+> **中文** | [English](#security-policy)
+
+---
+
+## 支持版本
+
+我们积极维护最新的 minor 版本。安全修复会 backport 到最新的 patch 版本，关键修复可能 backport 到前一个 minor 版本。
+
+| 版本 | 支持状态 | 说明 |
+|---|---|---|
+| 0.7.x | ✅ 支持 | 活跃开发中 |
+| 0.6.x | ⚠️ 尽力维护 | 仅关键修复 |
+| < 0.6.0 | ❌ 不支持 | 请升级至 0.7.x |
+
+**停止维护通知**：0.6.x 处于尽力维护阶段（仅关键修复）。停止维护的具体日期将提前公布；该日期之后将不再提供 0.6.x 的安全修复。
+
+---
+
+## 已知安全特性
+
+项目已实现并维护以下安全特性：
+
+| 特性 | 描述 | 状态 |
+|---|---|---|
+| `apiToken` 鉴权 | 配置 token 后，所有远程端点需 `Authorization: Bearer <apiToken>`，比较使用 `crypto.timingSafeEqual` | ✅ 已实现 |
+| `policyEpoch` 记忆治理 | 提升 `policyEpoch` 后，所有先前的 `dream_runs` 降级为历史证据，其 receipt 不再驱动实时记忆决策 | ✅ 已实现 |
+| `conflictFreezeEnabled` 冲突冻结 | 冲突记忆不自动合并，标记为待人工复核，保护数据完整性 | ✅ 已实现 |
+| CAS（比较并交换）守卫 | 防止并发写入冲突，确保原子写操作 | ✅ 已实现 |
+| Digest 基线审计 | 记忆更新与 digest 基线比对，检测未授权修改 | ✅ 已实现 |
+| `failure_memories` 审计轨迹 | 每次写入失败均记录，供取证分析 | ✅ 已实现 |
+| `recall_run` 搜索审计 | 每次搜索操作均记录时间戳和查询元数据 | ✅ 已实现 |
+| 本地优先数据处理 | embedding、rerank、记忆整理均在本地完成，数据不离开设备 | ✅ 已实现 |
+| 无遥测 | 无分析、无远程日志，设计上无网络请求 | ✅ 已实现 |
+| 查询净化 | LIKE 查询转义、分页边界限制、Markdown 镜像转义，防止注入和畸形输入 | ✅ 已实现 |
+| `entityExtractionEnabled` 实体抽取 Opt-In | 实体抽取为配置项、默认关闭（数据最小化原则） | ✅ 已实现 |
+| 优雅降级 | 组件故障时自动回退至关键词搜索，不崩溃 | ✅ 已实现 |
+| 人工可编辑镜像 | 所有记忆镜像至 Markdown 文件，用户可验证和重建数据 | ✅ 已实现 |
+| Mirror Generation CAS/Fence | 镜像同步绑定单调递增的 `generation` 计数器并采用 CAS/fence 语义，拒绝过期或并发镜像写入 | ✅ 已实现 |
+| 崩溃恢复债务模型 | 业务写入在自身事务内原子递增 `desired generation`；崩溃后 `recoverMirror` 依据债务重放修复，不再静默跳过 | ✅ 已实现 |
+| `/health` 鉴权门控 | 健康端点要求 `apiToken`；错误码净化（no-space / permission / sync-failed），读取失败 fail-closed 为 `unknown` | ✅ 已实现 |
+| Fail-Closed 输入校验 | generation 计数与热记忆参数均做 `Number.isInteger`、有限性、非负校验并配 SQL `CHECK` 约束；非法输入回退安全默认值或被拒绝 | ✅ 已实现 |
+| 混合分数钳制 | 混合检索融合分数钳制在 [0, 1]，防止向量 + BM25 叠加突破归一化边界 | ✅ 已实现 |
+| Tag 净化 | Tag 规范化复用 sanitizer；`autoTag` 跳过已遗忘记忆；`setMemoryTags` 在 SAVEPOINT 内执行，失败原子回滚 | ✅ 已实现 |
+
+---
+
+## 报告漏洞
+
+### 请不要
+
+- 在公开 issue 中披露安全漏洞
+- 在讨论区或评论中发布漏洞利用细节
+- 未经事先协调就提交暴露安全缺陷的 PR
+
+### 请这样做
+
+1. **发送邮件**至 `guanqishi26@gmail.com`（或通过 [GitHub 私有安全公告](https://github.com/modusensus/dsh-mneme/security/advisories) 提交）
+2. 邮件内容请包含：
+   - 漏洞的清晰描述
+   - 复现步骤（优先提供最小测试用例）
+   - 影响评估（数据泄露？仅本地？远程？）
+   - 受影响的版本
+   - 你建议的修复方案（如有）
+   - 是否要求在公告中署名 / 披露偏好
+
+### 响应时间线
+
+| 阶段 | 时间 | 行动 |
+|---|---|---|
+| 确认收到 | 48 小时内 | 我们确认收到并分配追踪 ID |
+| 初步评估 | 7 天内 | 我们验证严重程度和影响范围；可能需要更多信息 |
+| 修复开发 | 按严重程度 | 严重：≤ 14 天；高：≤ 30 天；中/低：下个版本 |
+| 验证与测试 | 修复完成后 1–3 天 | 对补丁进行回归测试和安全测试 |
+| 协调披露 | 修复发布时 | 同时发布安全公告和补丁版本 |
+
+**备注**：对于严重漏洞，如果 14 天内无法提供完整修复，我们将在该时间内提供临时缓解措施或替代方案。
+
+### 严重程度分级
+
+我们遵循 [CVSS v3.1](https://www.first.org/cvss/v3.1/specification-document) 标准：
+
+- **严重** (9.0–10.0)：远程代码执行、未授权数据外泄、核心安全控制绕过
+- **高** (7.0–8.9)：本地权限提升、重大数据完整性破坏、高影响 DoS
+- **中** (4.0–6.9)：特定条件下的信息泄露、部分控制绕过
+- **低** (0.1–3.9)：轻微信息泄露、纵深防御改进
+
+---
+
+## 安全设计原则
+
+### 1. 本地优先，零网络
+
+- 所有 embedding、rerank、记忆整理均在本地运行
+- 记忆文本**永不**离开设备
+- 无遥测、无分析、无远程日志
+
+### 2. 默认 Fail-Safe
+
+- 任何组件故障（LLM、embedder、reranker）均优雅降级到关键词搜索
+- 畸形输入不会导致插件崩溃或数据库损坏
+- 并发写入冲突通过 CAS（比较并交换）守卫解决
+
+### 3. 全面审计
+
+- 每次 `autoDream` 运行生成密码学可验证的 receipt
+- 每次记忆更新创建 `failure_memories` 审计轨迹
+- 每次搜索记录 `recall_run` 供后续检查
+
+### 4. 人类主权
+
+- 所有记忆镜像到人类可编辑的 Markdown 文件
+- 机器写入 vs 人工编辑通过 digest 基线区分
+- 用户可仅凭 Markdown 镜像完整重建数据库
+
+### 5. 最小远程暴露面
+
+- 远程 API 端点为可选：需配置 `apiToken` 才生效
+- 配置 token 后，每个远程请求均经过 timing-safe 比较
+- 未配置 token 时，远程端点实际处于禁用状态，所有处理均在本地
+
+---
+
+## 依赖漏洞处理
+
+### 处理流程
+
+我们采用 5 步流程处理第三方依赖漏洞：
+
+| 步骤 | 行动 | 时间要求 | 工具 |
+|---|---|---|---|
+| 1. 扫描 | 对所有运行时和开发依赖进行持续自动扫描 | 自动（每日） | OrbisAI Security、npm audit |
+| 2. 评估 | 对每个检测到的漏洞评估严重程度、可利用性和对 dsh-mneme 的影响 | 检测后 48 小时内 | CVSS v3.1、人工代码分析 |
+| 3. 上报 | 将发现记录到安全追踪器，并上报给维护者 | 评估后立即 | 安全追踪器、维护者通道 |
+| 4. 修复 | 升级依赖至已修复版本或应用缓解措施 | 严重：≤ 14 天；高：≤ 30 天；中/低：下个版本 | npm/pnpm 更新、手动补丁 |
+| 5. 披露 | 发布包含详情和已修复版本的安全公告 | 修复版本发布时 | GitHub Security Advisories + npm 发布说明 |
+
+### 第三方依赖政策
+
+- 所有新增运行时依赖需通过安全审查后方可引入
+- 存在已知严重漏洞且在期限内无法修复的依赖将被替换为替代方案
+- 依赖锁文件（`package-lock.json`）已提交并在 PR 中审查
+
+### 近期依赖修复
+
+| CVE | 包 | 修复前版本 | 修复后版本 | 严重程度 | 修复版本 |
+|---|---|---|---|---|---|
+| CVE-2026-39244 | `adm-zip` | 0.5.18 | 0.6.0 | 高 | v0.3.4 |
+
+---
+
+## 安全审计历史
+
+### v0.2.10 — 安全加固
+
+| ID | 发现 | 严重程度 | 状态 |
+|---|---|---|---|
+| F-NEW-01 | `store.js` 并发写入竞态 | **严重** | ✅ 已修复（CAS 守卫 + 原子写入） |
+| F-NEW-02 | 镜像同步期间事务不一致 | **高** | ✅ 已修复（事务化镜像 + 回滚） |
+| F-NEW-03 | 覆盖前未验证镜像健康状态 | **高** | ✅ 已修复（digest 基线 + FSM 验证） |
+
+### v0.3.4 — 依赖安全
+
+| CVE | 包 | 严重程度 | 状态 |
+|---|---|---|---|
+| CVE-2026-39244 | `adm-zip` 0.5.18 | **高** | ✅ 已修复（升级至 0.6.0） |
+
+### v0.3.6 — Mirror 债务建模（审计 peer 复核修复）
+
+| 发现 | 严重程度 | 状态 |
+|---|---|---|
+| 镜像同步未绑定 generation 计数器（过期覆盖窗口） | **高** | ✅ 已修复（generation + CAS/fence 语义，per-type 状态） |
+| `/health` 端点未鉴权且错误码冗长 | **高** | ✅ 已修复（鉴权门控、错误码净化、读取失败 fail-closed `unknown`） |
+| COMMIT-崩溃窗口可能永久跳过镜像修复 | **高** | ✅ 已修复（dirty 或 generation > applied 时触发 recoverMirror） |
+
+### v0.3.8 — Mirror 同步可靠性（peer 6 blockers）
+
+| 发现 | 严重程度 | 状态 |
+|---|---|---|
+| 镜像同步静默失败（错误未上抛至写路径） | **高** | ✅ 已修复（`syncMirror` 返回 `{success, error}`；写入口 `afterSync` 检查） |
+| 多进程并发下 generation 非原子递增 | **高** | ✅ 已修复（`UPDATE ... RETURNING` 原子语句 + `PRAGMA busy_timeout=5000`） |
+| generation 溢出 / 负值 | **中** | ✅ 已修复（JS 校验 + SQL `CHECK(0..MAX_SAFE_INTEGER)`） |
+
+### v0.3.9 — 审计 A/B/D/F
+
+| 发现 | 严重程度 | 状态 |
+|---|---|---|
+| CAS 更新与 generation 递增不在同一事务 | **高** | ✅ 已修复（`runAtomically` 原子执行；miss 不递增） |
+| 失败更新可能虚报成功 | **高** | ✅ 已修复（degraded/pending 回执，带 mirror 属性） |
+| generation 校验未 fail-closed | **中** | ✅ 已修复（`Number.isInteger` fail-closed + 迁移检测旧脏值） |
+
+### v0.5.1 — 热记忆负参数防御
+
+| 发现 | 严重程度 | 状态 |
+|---|---|---|
+| 负 / 非有限 `maxRounds`/`maxTokens` 可经公开 API 触发同步死循环 | **高** | ✅ 已修复（回退安全默认值 5/2000） |
+| 混合融合分数可超过 1.0（向量 + BM25 叠加） | **中** | ✅ 已修复（钳制到 [0, 1]） |
+
+### v0.6.5 — Tag 系统加固
+
+| 发现 | 严重程度 | 状态 |
+|---|---|---|
+| `autoTag` 可能给已遗忘记忆打标签 | **中** | ✅ 已修复（打标前过滤 `forgotten`） |
+| Tag 规范化绕过 sanitizer | **中** | ✅ 已修复（`normalizeTags` 复用 `sanitize`） |
+| `setMemoryTags` 失败时非原子 | **中** | ✅ 已修复（SAVEPOINT 回滚） |
+
+### 持续进行
+
+- 通过 **OrbisAI Security** 进行自动化依赖扫描
+- 欢迎社区通过私有公告提交安全审查
+
+---
+
+## 安全公告渠道
+
+安全公告通过以下渠道同时发布：
+
+1. **[GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories)** — 主要渠道，包含详细技术信息
+2. **[npm Releases](https://www.npmjs.com/package/@modusensus/dsh-mneme)** — 发布说明中包含安全公告和修复摘要
+
+接收安全通知方式：
+- **GitHub**：Watch 仓库并在仓库设置中启用“安全警报”
+- **npm**：订阅 `@modusensus/dsh-mneme` 的发布通知
+
+---
+
+## 披露政策
+
+我们实行**协调披露**：
+
+1. 报告者私下提交漏洞
+2. 我们在 48 小时内确认收到
+3. 我们开发修复并准备公告（时间取决于严重程度）
+4. 我们通知报告者修复时间线和计划披露日期
+5. 我们同时发布补丁和安全公告
+6. 我们在公告中致谢报告者（经其同意）
+
+我们**不会**对以下安全研究人员采取法律行动：
+- 出于善意行事
+- 不将漏洞利用超出概念验证范围
+- 不访问属于他人的数据
+- 在公开披露前给予我们合理的响应时间
+
+**漏洞赏金政策**：本项目目前不提供经济奖励。我们会在公告中公开致谢报告者（经其同意）。
+
+---
+
+## 安全日志与数据保留
+
+所有审计数据**本地**存储于插件数据库，不离开设备：
+
+| 数据类型 | 存储位置 | 说明 |
+|---|---|---|
+| `failure_memories` 审计日志 | 本地数据库 | 每次写入失败均记录，供取证分析 |
+| `recall_run` 搜索日志 | 本地数据库 | 每次搜索均记录时间戳和查询元数据 |
+| AutoDream receipts | 本地数据库 + Markdown 镜像 | 密码学可验证；保留至用户删除 |
+| 依赖扫描报告 | OrbisAI Security 控制台 | 不存储于设备 |
+
+保留期由用户控制：审计记录仅随本地数据库存续。无远程日志、无遥测。
+
+---
+
+## 安全相关配置
+
+```yaml
+# 加固配置示例（键均对应 src/config.js 实际配置，除注明外）
+dsh-mneme:
+  # 如需完全手动控制，可禁用 autoDream
+  autoDream: false
+
+  # 敏感环境启用冲突冻结
+  conflictFreezeEnabled: true
+
+  # 仅使用本地 embedding（无网络）
+  embedProvider: local
+
+  # 远程端点需 Authorization: Bearer <apiToken>（timing-safe）
+  apiToken: "set-a-strong-unique-token"
+
+  # 提升以将先前的 dream_runs 降级为历史证据
+  policyEpoch: 1
+
+  # 实体抽取默认关闭（数据最小化）
+  entityExtractionEnabled: false
+
+  # Rerank 为 opt-in（默认关闭）——未启用时不下载额外模型
+  rerankEnabled: false
+
+  # 自动打标签默认关闭（数据最小化）
+  autoTagEnabled: false
+
+  # 不需要会话级清理时可关闭会话生命周期
+  sessionLifecycleEnabled: false
+
+  # 不需要后台维护时可关闭 Sleep Mode
+  sleepModeEnabled: false
+
+  # 记忆可信度加权为 opt-in（默认关闭）
+  trustEpistemicWeighting: false
+
+  # LLM 审计日志保留天数
+  llmAudit:
+    enabled: true
+    retentionDays: 90
+```
+
+---
+
+## 贡献者安全指南
+
+所有贡献者必须遵守以下安全要求：
+
+1. **依赖审计**：提交 PR 前运行 `npm audit`；新增依赖必须通过安全审查
+2. **密钥扫描**：禁止向仓库提交 API 密钥、令牌或凭据
+3. **输入验证**：所有用户输入必须验证和净化（包括 LLM 相关内容）
+4. **安全代码审查**：涉及安全相关变更的 PR 需获得具有安全专业知识维护者的批准
+5. **文档记录**：新功能必须在 PR 描述中包含安全影响分析
+6. **负责任的披露**：开发过程中发现的安全漏洞必须通过适当渠道报告，而非在公开 PR 中提交
+
+---
+
+## 联系方式
+
+- **安全团队**：`guanqishi26@gmail.com`
+- **私有公告**：[GitHub Security Advisories](https://github.com/modusensus/dsh-mneme/security/advisories)
+- **GPG 密钥**：如需加密通信，可应请求提供
+
+---
+
+## 许可协议
+
+本项目基于 **MIT License** 开源。详见 [LICENSE](https://github.com/modusensus/dsh-mneme/blob/main/LICENSE)。
+
+---
+
+*Last updated: 2026-08-28*  
+*Policy version: 2.2*