SECURITY

Vulnerability disclosure, scope, and data practices. widemem is Apache 2.0 and source-available, so every claim on this page is auditable in the repository.

Reporting a vulnerability

If you find a security issue in widemem, do not open a public GitHub issue. Email the details to radu@cioplea.com with:

• A description of the vulnerability
• Steps to reproduce
• Potential impact
• A suggested fix, if you have one

You should receive a response within 48 hours. I will work with you to understand the issue and coordinate a fix before any public disclosure.

Supported versions

Security patches are issued for the latest minor version of widemem. Older versions receive fixes only for critical issues. The authoritative version list is in the repository SECURITY.md.

Scope

widemem is a library, not a service. Security concerns include:

• Data storage. Memories are stored in local SQLite and FAISS files. You are responsible for setting appropriate filesystem permissions on ~/.widemem/ or any custom data directory.
• LLM API keys. Keys pass through config or environment variables. widemem does not log, transmit, or store API keys beyond what the underlying provider SDKs do.
• Prompt injection. User-provided text is sent to LLMs for extraction and conflict resolution. If you process untrusted input, be aware that adversarial text can influence extraction results. Sanitize upstream or use a lower-trust user scope.
• YMYL is not a security boundary. The YMYL classifier uses keyword matching for prioritization. It is not a content filter, an access control mechanism, or a compliance tool. It raises the importance of health, financial, and legal facts. That is all.

Data practices

• Local-first. The default configuration writes every memory and the full audit trail to disk on your machine. No data is sent to widemem.ai.
• Zero telemetry. widemem does not phone home. No analytics, no usage reporting, no crash reports sent anywhere by default.
• Audit trail. Every add, update, and delete is logged to a local SQLite history database. Query it with memory.get_history(memory_id). Nothing is silent.
• Retention. Configure ttl_days on MemoryConfig to auto-expire memories after N days. YMYL-classified facts bypass TTL intentionally.
• LLM providers. If you use OpenAI or Anthropic, those providers see the text you send them under their respective privacy policies. If you use Ollama locally, no text leaves your machine.

Compliance stance

widemem is not itself SOC2 or HIPAA certified. It is a library you embed into a service whose compliance posture you control. The library gives you the building blocks (local storage, configurable retention, full audit trail, local-only LLM and embedding options). Teams that need dedicated help with a compliance review can start at the enterprise page.

Canonical source

The formal security policy lives in the repository as SECURITY.md. If this page and that file ever disagree, the file in the repository is authoritative.