Security updates are provided for the latest minor version of Engram. When a new minor version is released, security support for the previous minor version ends.

Do not open a public GitHub issue for security vulnerabilities. Instead, email [email protected] with:

• Title of the vulnerability
• Description and impact
• Steps to reproduce (if applicable)
• Affected version(s)

We will:

1. Acknowledge receipt within 48 hours
2. Provide an initial assessment within 1 week
3. Coordinate a fix and release timeline

• Authentication or authorization bypasses
• Data exposure or leakage
• SQL injection or code injection vulnerabilities
• Cryptographic weaknesses
• Denial of service attacks
• Privilege escalation

Engram never stores API keys or secrets in code. All credentials must be provided via:

• Environment variables
• Configuration files outside version control
• A secret manager appropriate to your deployment (cloud KMS, HashiCorp Vault, Doppler, Supabase Vault if you use hosted Supabase, etc.)

Engram itself is BYO infrastructure as of v0.4.0 — there is no built-in coupling to any single vendor's secret store.

If you discover hardcoded secrets, report them immediately to [email protected].

Thank you for helping keep Engram secure.