Security
last updated · july 2026
Reporting a vulnerability
If you discover a security vulnerability, please report it privately by email to onur@omelas.tech. Please do not open a public GitHub issue for security reports. You should receive a response within 48 hours. Include a description of the issue, steps to reproduce, and the potential impact.
A machine-readable contact is published at /.well-known/security.txt, and the canonical policy lives in SECURITY.md.
Local-first by default
By default, your memories are plain files in ~/.brain/ on your own disk and never leave it. The hosted Brain Cloud sync hub and the Claude connector are entirely opt-in. If you never enable a sync provider, nothing is ever sent to external servers, and the smallest attack surface is the one you get out of the box.
Encryption for Git & export sync
When you sync to a Git remote or an export file, memory files can be encrypted with AES-256-GCM using a passphrase you provide (key derived with PBKDF2-SHA512, 100K iterations). Brain Memory never stores credentials — Git sync relies on your existing SSH keys or Git credential helpers.
How the hosted service protects your data
When you choose to use Brain Cloud or the connector, your data is protected in depth:
- Encrypted at rest. Brains in Brain Cloud are encrypted on disk with AES-256-GCM using a per-user key wrapped by Google Cloud KMS (EU-hosted); the key material never leaves KMS. A stolen disk, backup, or snapshot yields no readable memories.
- No plaintext on the connector. The connector holds each user's working copy in RAM only (a tmpfs) and purges it on an idle timeout, at session end, and on restart — it is never written to the connector's disk.
- Encrypted in transit. All traffic to Brain Cloud and the connector is HTTPS/TLS.
- Strict tenant isolation. Every request is authorized against the authenticated account; one account can never read or overwrite another's brain.
- Revocable sessions. CLI sessions use rotating refresh tokens with automatic reuse detection — a replayed token revokes the whole session family. Log out one device or all devices at any time, and revoke the connector from your Claude account.
- Verified-identity sign-in. Login is Google OAuth via Firebase; account-linking requires a verified email.
- Least privilege. The connector runs as an unprivileged, sandboxed service (systemd hardening: no new privileges, read-only filesystem, private tmp).
Because recall runs server-side, this is server-side encryption at rest, not end-to-end encryption — the service necessarily processes your memories in memory to score them. If you require that no server ever sees your memories in plaintext, keep your brain local-only (the default) or use Git/export sync with a passphrase.
Supply-chain posture
- No runtime dependencies. The
brain-memorypackage is pure file I/O with no third-party runtime deps, minimizing the supply-chain attack surface. - No telemetry. The package collects no usage data or analytics and operates entirely offline.
- No stored credentials. Brain Memory never persists auth tokens; sync uses your existing Git/SSH authentication.
Supported versions
Brain Memory is in beta. Security fixes are shipped against the current 0.1.x beta line. See the changelog for what has shipped.