memorio 3.0.0 → 3.0.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (37) hide show
  1. package/CODE_OF_CONDUCT.md +1 -1
  2. package/README.md +209 -328
  3. package/SECURITY.md +48 -3
  4. package/docs/README.md +209 -328
  5. package/docs/markdown/CACHE.md +3 -3
  6. package/docs/markdown/CHANGELOG.md +63 -154
  7. package/docs/markdown/DEVTOOLS.md +1 -1
  8. package/docs/markdown/IDB.md +3 -3
  9. package/docs/markdown/LOGGER.md +2 -2
  10. package/docs/markdown/OBSERVER.md +4 -4
  11. package/docs/markdown/PLATFORM.md +5 -5
  12. package/docs/markdown/SECURITY.md +16 -4
  13. package/docs/markdown/SESSION.md +4 -4
  14. package/docs/markdown/STATE.md +7 -7
  15. package/docs/markdown/STORE.md +7 -7
  16. package/docs/markdown/USEOBSERVER.md +1 -1
  17. package/examples/basic.ts +22 -22
  18. package/examples/browser-vanilla.html +2 -2
  19. package/examples/cache.ts +9 -9
  20. package/examples/idb.ts +8 -8
  21. package/examples/node-server.ts +39 -39
  22. package/examples/observer.ts +5 -5
  23. package/examples/platform.ts +37 -37
  24. package/examples/react-app.tsx +9 -4
  25. package/examples/session-advanced.ts +8 -8
  26. package/examples/state-advanced.ts +10 -10
  27. package/examples/store-advanced.ts +9 -9
  28. package/examples/useObserver.tsx +1 -1
  29. package/index.cjs +126 -117
  30. package/index.js +126 -117
  31. package/package.json +3 -3
  32. package/types/cache.d.ts +1 -1
  33. package/types/idb.d.ts +1 -1
  34. package/types/memorio.d.ts +6 -0
  35. package/types/observer.d.ts +1 -1
  36. package/types/store.d.ts +10 -10
  37. package/types/useObserver.d.ts +1 -1
package/SECURITY.md CHANGED
@@ -1,3 +1,48 @@
1
- # Security
2
-
3
- Please email [@passariello](https://github.com/passariello) or see https://dario.passariello.ca/contact/ if you have a potential security vulnerability to report.
1
+ # Security
2
+
3
+ Memorio follows NIST and NSA security standards at the enterprise level.
4
+
5
+ ## Security Standards
6
+
7
+ - **NIST Guidelines**: Follows NIST SP 800-53 security controls and NIST Cybersecurity Framework
8
+ - **NSA Standards**: Defense-grade security practices; considers nation-state level threats in risk assessment
9
+
10
+ ## Supply Chain Security
11
+
12
+ - **Socket.dev**: Minimum target score 90%; all alarms must be resolved before release
13
+ - **Dependency Management**: Zero production dependencies (fully dependency-free); dev dependencies audited regularly
14
+ - **Prohibited**: No `eval()` usage, no encrypted/obfuscated code in builds, no hardcoded secrets
15
+
16
+ ## Code Security
17
+
18
+ - No hardcoded credentials or API keys
19
+ - Secure random session ID generation (`crypto.randomUUID` → `crypto.getRandomValues` → fallback)
20
+ - Input validation on all public APIs
21
+ - XSS prevention on DevTools data export
22
+ - Property-based access control on global objects (`Object.defineProperty` with `enumerable: false`)
23
+
24
+ ## OWASP Compliance
25
+
26
+ Addresses OWASP Top 10 (2021):
27
+ - A01:2021 — Broken Access Control (global object protection, property locks)
28
+ - A02:2021 — Cryptographic Failures (crypto.randomUUID for session IDs)
29
+ - A03:2021 — Injection (CSS sanitization in devtools)
30
+ - A05:2021 — Security Misconfiguration (minimal surface area, no bundled secrets)
31
+ - A06:2021 — Vulnerable and Outdated Components (regular npm audit, Socket.dev)
32
+ - A07:2021 — Identification and Authentication Failures (N/A — library, no auth)
33
+ - A08:2021 — Software and Data Integrity Failures (strict tsconfig, lock files)
34
+ - A09:2021 — Security Logging and Monitoring Failures (DevTools inspect, Logger module)
35
+ - A10:2021 — Server-Side Request Forgery (N/A — no network requests)
36
+
37
+ ## Reporting Security Issues
38
+
39
+ If you find a security vulnerability:
40
+
41
+ 1. Email [Dario Passariello](mailto:dariopassarielloa@gmail.com)
42
+ 2. Or visit https://dario.passariello.ca/contact/
43
+
44
+ Do not open public issues for security vulnerabilities.
45
+
46
+ ---
47
+ *Document version: 2.0 — Last updated: 2026-05-19*
48
+ *Owner: BigLogic Security Team*