memorio 4.6.4 → 4.6.6

package/COPYRIGHT.md

@@ -0,0 +1,6 @@
+# Copyright
+
+Copyright (c) 2025, Dario Passariello. All rights reserved.
+<https://dario.passariello.ca>
+
+This software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software.

package/LICENSE.md

@@ -0,0 +1,21 @@
+# MIT License
+
+Copyright (c) 2025 Dario Passariello
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/SECURITY.md

@@ -0,0 +1,48 @@
+# Security
+
+Memorio follows NIST and NSA security standards at the enterprise level.
+
+## Security Standards
+
+- **NIST Guidelines**: Follows NIST SP 800-53 security controls and NIST Cybersecurity Framework
+- **NSA Standards**: Defense-grade security practices; considers nation-state level threats in risk assessment
+
+## Supply Chain Security
+
+- **Socket.dev**: Minimum target score 90%; all alarms must be resolved before release
+- **Dependency Management**: Zero production dependencies (fully dependency-free); dev dependencies audited regularly
+- **Prohibited**: No `eval()` usage, no encrypted/obfuscated code in builds, no hardcoded secrets
+
+## Code Security
+
+- No hardcoded credentials or API keys
+- Secure random session ID generation (`crypto.randomUUID` → `crypto.getRandomValues` → fallback)
+- Input validation on all public APIs
+- XSS prevention on DevTools data export
+- Property-based access control on global objects (`Object.defineProperty` with `enumerable: false`)
+
+## OWASP Compliance
+
+Addresses OWASP Top 10 (2021):
+- A01:2021 — Broken Access Control (global object protection, property locks)
+- A02:2021 — Cryptographic Failures (crypto.randomUUID for session IDs)
+- A03:2021 — Injection (CSS sanitization in devtools)
+- A05:2021 — Security Misconfiguration (minimal surface area, no bundled secrets)
+- A06:2021 — Vulnerable and Outdated Components (regular npm audit, Socket.dev)
+- A07:2021 — Identification and Authentication Failures (N/A — library, no auth)
+- A08:2021 — Software and Data Integrity Failures (strict tsconfig, lock files)
+- A09:2021 — Security Logging and Monitoring Failures (DevTools inspect, Logger module)
+- A10:2021 — Server-Side Request Forgery (N/A — no network requests)
+
+## Reporting Security Issues
+
+If you find a security vulnerability:
+
+1. Email [Dario Passariello](mailto:dariopassarielloa@gmail.com)
+2. Or visit https://dario.passariello.ca/contact/
+
+Do not open public issues for security vulnerabilities.
+
+---
+*Document version: 2.0 — Last updated: 2026-05-19*
+*Owner: BigLogic Security Team*