Memorio Security Documentation

Last Updated: v2.7.0

This document describes the security measures implemented in Memorio to protect against common vulnerabilities and ensure safe operation across different platforms.

Security Overview

Memorio implements multiple layers of security to protect user data and prevent common attack vectors:

1. Cryptographically Secure Random Generation

Implementation

Session and context IDs are generated using cryptographically secure random values:

// config/platform.ts
function generateSessionId(): string {
  // Priority 1: crypto.randomUUID (most secure)
  if (typeof crypto !== 'undefined' && crypto.randomUUID) {
    return crypto.randomUUID()
  }

  // Priority 2: crypto.getRandomValues (secure fallback)
  if (typeof crypto !== 'undefined' && crypto.getRandomValues) {
    const array = new Uint8Array(16)
    crypto.getRandomValues(array)
    return Array.from(array, b => b.toString(16).padStart(2, '0')).join('')
  }

  // Priority 3: Math.random (last resort - less secure)
  return `session_${Date.now()}_${Math.random().toString(36).substring(2, 15)}`
}

Random Source Priority

2. Input Validation & Key Sanitization

All storage keys are validated before use to prevent injection attacks:

Validation Rules

Implementation

function _prefixKey(name: string): string {
  // Validate key
  if (!name || typeof name !== 'string') return ''
  if (name.length > 512) {
    console.debug('Key too long (max 512 characters)')
    return ''
  }
  // Sanitize: only allow alphanumeric, underscore, dash, dot
  if (!/^[a-zA-Z0-9_.-]+$/.test(name)) {
    console.debug('Key contains invalid characters')
    return ''
  }
  return _sessionPrefix + name
}

Allowed Characters Table

3. Session Isolation

Each session gets a unique namespace to prevent data leakage:

Isolation Mechanism

Key Prefix Format

memorio_store_[session-uuid]_username
memorio_session_[session-uuid]_auth-token

Cross-Session Protection

4. Context Isolation (Multi-Tenant)

For server-side applications, contexts provide complete data isolation:

// Create isolated context per tenant
const tenantA = memorio.createContext('tenant-A')
const tenantB = memorio.createContext('tenant-B')

// Each context has completely separate storage
tenantA.state.secret = 'Tenant A data'  // Isolated
tenantB.state.secret = 'Tenant B data'  // Isolated

Context Security

5. Data Serialization Security

Safe Operations

Blocked Types

// These are blocked and logged:
store.set('myFunc', () => {})  // "It's not secure to store functions."
store.set('mySymbol', Symbol('test'))  // Would fail serialization

6. Platform-Specific Security

Browser Environment

Server Environment (Node.js/Deno)

7. Security Best Practices

For Developers

1. Use Contexts in Server Apps

   // Express middleware
   app.use((req, res, next) => {
     req.memorio = memorio.createContext(`req-${req.id}`)
     next()
   })
   

2. Validate Keys

   // Don't use user input directly as keys
   const safeKey = sanitize(userInput) // Input validation
   store.set(safeKey, value)
   

3. Check Persistence

   if (!store.isPersistent) {
     console.warn('Data not persisted!')
   }
   

4. Clear Sensitive Data

   // On logout
   session.removeAll()
   state.removeAll()
   

For Security Audits

8. Vulnerability Prevention

Prevention Matrix

9. Compliance

Standards Alignment

10. Reporting Security Issues

If you discover a security vulnerability in Memorio:

1. Do NOT open a public GitHub issue
2. Email: security@example.com (replace with actual contact)
3. Include: Vulnerability details, steps to reproduce, potential impact

Response Timeline

Security Changelog

v2.7.0 (Current)

• ✅ Added crypto.getRandomValues() fallback
• ✅ Added key length validation (512 chars)
• ✅ Added character whitelist validation
• ✅ Improved session isolation
• ✅ Context isolation for multi-tenancy

This document was last updated for Memorio v2.7.0