Security model

Storage, isolation, and what we never see.

  • Local storage: SQLite at ~/.mnueron/memories.db. You own the file. Back it up with cp.
  • Redaction: 13 regex patterns + Bearer/Basic-auth heuristics strip secrets at write time. Original text never persists.
  • Hosted isolation: Postgres Row-Level Security scopes every query to your org. Each connection sets app.current_org_id and switches to the restricted role.
  • Session cookies: httpOnly + Secure + SameSite=Lax. The raw token never reaches client-side JS.
  • Token revocation: Anytime via DELETE /v1/auth/tokens/:id. Multi-device sessions are independent.
Last updated 2026-05-16edit