00

Security

last updated · july 2026

Reporting a vulnerability

If you discover a security vulnerability, please report it privately by email to onur@omelas.tech. Please do not open a public GitHub issue for security reports. You should receive a response within 48 hours. Include a description of the issue, steps to reproduce, and the potential impact.

A machine-readable contact is published at /.well-known/security.txt, and the canonical policy lives in SECURITY.md.

Memory-poisoning defense

Because Brain reloads stored memories into the model, a memory absorbed from untrusted content — an email, a web page, a tool result — is an injection vector. Brain treats where a memory came from as a first-class property and implements all five OWASP ASI06 defense layers: origin ceilings that stop untrusted content from pinning or entrenching, trust-weighted recall, a write-time lint for instruction-shaped payloads, quarantine of untrusted writes for review, anomaly detection (brain audit), and an append-only audit log with one-command rollback. Because memories are plain files, Brain additionally records a SHA-256 baseline of every memory at write time, so brain audit also detects edits made outside any write path — the one poisoning route the write-path defenses are blind to. See Provenance & Trust.

Local-first by default

By default, your memories are plain files in ~/.brain/ on your own disk and never leave it. The hosted Brain Cloud sync hub and the Claude connector are entirely opt-in. If you never enable a sync provider, nothing is ever sent to external servers, and the smallest attack surface is the one you get out of the box.

Encryption for Git & export sync

When you sync to a Git remote or an export file, memory files can be encrypted with AES-256-GCM using a passphrase you provide (key derived with PBKDF2-SHA512, 100K iterations). Brain Memory never stores credentials — Git sync relies on your existing SSH keys or Git credential helpers.

How the hosted service protects your data

When you choose to use Brain Cloud or the connector, your data is protected in depth:

  • Encrypted at rest. Brains in Brain Cloud are encrypted on disk with AES-256-GCM using a per-user key wrapped by Google Cloud KMS (EU-hosted); the key material never leaves KMS. A stolen disk, backup, or snapshot yields no readable memories.
  • No plaintext on the connector. The connector holds each user's working copy in RAM only (a tmpfs) and purges it on an idle timeout, at session end, and on restart — it is never written to the connector's disk.
  • Encrypted in transit. All traffic to Brain Cloud and the connector is HTTPS/TLS.
  • Strict tenant isolation. Every request is authorized against the authenticated account; one account can never read or overwrite another's brain.
  • Revocable sessions. CLI sessions use rotating refresh tokens with automatic reuse detection — a replayed token revokes the whole session family. Log out one device or all devices at any time, and revoke the connector from your Claude account.
  • Verified-identity sign-in. Login is Google OAuth via Firebase; account-linking requires a verified email.
  • Least privilege. The connector runs as an unprivileged, sandboxed service (systemd hardening: no new privileges, read-only filesystem, private tmp).

Because recall runs server-side, this is server-side encryption at rest, not end-to-end encryption — the service necessarily processes your memories in memory to score them. If you require that no server ever sees your memories in plaintext, keep your brain local-only (the default) or use Git/export sync with a passphrase.

Supply-chain posture

  • No runtime dependencies. The brain-memory package is pure file I/O with no third-party runtime deps, minimizing the supply-chain attack surface.
  • No telemetry. The package collects no usage data or analytics and operates entirely offline.
  • No stored credentials. Brain Memory never persists auth tokens; sync uses your existing Git/SSH authentication.

Supported versions

Security fixes are shipped against the current 0.1.x release line. See the changelog for what has shipped.

Contact

onur@omelas.tech