memorio 4.6.7 → 4.6.9

package/COPYRIGHT.md

@@ -0,0 +1,6 @@
+# Copyright
+
+Copyright (c) 2025, Dario Passariello. All rights reserved.
+<https://dario.passariello.ca>
+
+This software is provided "as is", without warranty of any kind, express or implied, including but not limited to the warranties of merchantability, fitness for a particular purpose and noninfringement. In no event shall the authors or copyright holders be liable for any claim, damages or other liability, whether in an action of contract, tort or otherwise, arising from, out of or in connection with the software or the use or other dealings in the software.

package/SECURITY.md

@@ -0,0 +1,48 @@
+# Security
+
+Memorio follows NIST and NSA security standards at the enterprise level.
+
+## Security Standards
+
+- **NIST Guidelines**: Follows NIST SP 800-53 security controls and NIST Cybersecurity Framework
+- **NSA Standards**: Defense-grade security practices; considers nation-state level threats in risk assessment
+
+## Supply Chain Security
+
+- **Socket.dev**: Minimum target score 90%; all alarms must be resolved before release
+- **Dependency Management**: Zero production dependencies (fully dependency-free); dev dependencies audited regularly
+- **Prohibited**: No `eval()` usage, no encrypted/obfuscated code in builds, no hardcoded secrets
+
+## Code Security
+
+- No hardcoded credentials or API keys
+- Secure random session ID generation (`crypto.randomUUID` → `crypto.getRandomValues` → fallback)
+- Input validation on all public APIs
+- XSS prevention on DevTools data export
+- Property-based access control on global objects (`Object.defineProperty` with `enumerable: false`)
+
+## OWASP Compliance
+
+Addresses OWASP Top 10 (2021):
+- A01:2021 — Broken Access Control (global object protection, property locks)
+- A02:2021 — Cryptographic Failures (crypto.randomUUID for session IDs)
+- A03:2021 — Injection (CSS sanitization in devtools)
+- A05:2021 — Security Misconfiguration (minimal surface area, no bundled secrets)
+- A06:2021 — Vulnerable and Outdated Components (regular npm audit, Socket.dev)
+- A07:2021 — Identification and Authentication Failures (N/A — library, no auth)
+- A08:2021 — Software and Data Integrity Failures (strict tsconfig, lock files)
+- A09:2021 — Security Logging and Monitoring Failures (DevTools inspect, Logger module)
+- A10:2021 — Server-Side Request Forgery (N/A — no network requests)
+
+## Reporting Security Issues
+
+If you find a security vulnerability:
+
+1. Email [Dario Passariello](mailto:dariopassarielloa@gmail.com)
+2. Or visit https://dario.passariello.ca/contact/
+
+Do not open public issues for security vulnerabilities.
+
+---
+*Document version: 2.0 — Last updated: 2026-05-19*
+*Owner: BigLogic Security Team*

package/SUMMARY.md

@@ -0,0 +1,28 @@
+# Table of contents
+
+* [README](README.md)
+
+## Core Modules
+
+* [State](markdown/STATE.md) - Reactive global state management
+* [Observer](markdown/OBSERVER.md) - Object observation pattern
+* [useObserver](markdown/USEOBSERVER.md) - React hook for state observation
+* [Dispatch](markdown/DISPATCH.md) - Event system for vanilla JS applications
+* [Cache](markdown/CACHE.md) - In-memory caching (lost on refresh)
+* [Store](markdown/STORE.md) - Persistent localStorage management
+* [Session](markdown/SESSION.md) - Temporary sessionStorage management
+* [IDB](markdown/IDB.md) - IndexedDB for large data storage
+
+## Platform & Compatibility
+
+* [Platform & Context Isolation](markdown/PLATFORM.md) - Cross-platform support, session isolation
+* [Security](markdown/SECURITY.md) - Security measures, vulnerability prevention
+* [Changelog](markdown/CHANGELOG.md) - Version history and migration guide
+* [Classic Import](markdown/IMPORT.md) - Named export guide for `import { state } from 'memorio'`
+
+## Additional Resources
+
+* [License](../LICENSE.md)
+* [Contributing](../CONTRIBUTING.md)
+* [Code of Conduct](../CODE_OF_CONDUCT.md)
+* [Security](../SECURITY.md)