MemPalace follows semantic versioning. Security fixes land on the current major version line.

Please do not report security vulnerabilities through public GitHub issues.

We take the security of MemPalace seriously. If you believe you have found a security vulnerability, please report it privately using GitHub Private Vulnerability Reporting:

1. Open the Security tab of this repository.
2. Click Advisories → Report a vulnerability.
3. Fill in the form with the details below.

• A descriptive summary of the vulnerability.
• Detailed steps to reproduce the issue (including any proof-of-concept scripts or specific file paths).
• The affected version(s) and platform(s).
• The potential impact and severity.

• We aim to acknowledge receipt within 48 hours.
• We will triage the issue and keep you updated on progress toward a patch.
• Once the vulnerability is resolved and an update is released, we will publish a security advisory and credit you for the discovery (if you wish to be credited).

MemPalace's default Chroma backend uses the embedded PersistentClient, which opens the palace directory in-process and listens on no network port. If you instead run a separate chroma run / Chroma HTTP server (for example to share a palace between hosts), keep it on localhost or a private network behind authenticated access and never expose it to the public internet. Several 2026 advisories affect the Python/FastAPI Chroma server and, at the time of writing, list no fixed release: CVE-2026-45829 (pre-authentication code injection), CVE-2026-45833 (authenticated code injection through a collection update), and CVE-2026-45830 and CVE-2026-45831 (tenant-authorization/RBAC issues). They do not apply to the embedded client MemPalace uses by default.