# Security

Memorio follows NIST and NSA security standards at the enterprise level.

## Security Standards

- **NIST Guidelines**: Follows NIST SP 800-53 security controls and NIST Cybersecurity Framework
- **NSA Standards**: Defense-grade security practices; considers nation-state level threats in risk assessment

## Supply Chain Security

- **Socket.dev**: Minimum target score 90%; all alarms must be resolved before release
- **Dependency Management**: Zero production dependencies (fully dependency-free); dev dependencies audited regularly
- **Prohibited**: No `eval()` usage, no encrypted/obfuscated code in builds, no hardcoded secrets

## Code Security

- No hardcoded credentials or API keys
- Secure random session ID generation (`crypto.randomUUID` → `crypto.getRandomValues` → fallback)
- Input validation on all public APIs
- XSS prevention on DevTools data export
- Property-based access control on global objects (`Object.defineProperty` with `enumerable: false`)

## OWASP Compliance

Addresses OWASP Top 10 (2021):
- A01:2021 — Broken Access Control (global object protection, property locks)
- A02:2021 — Cryptographic Failures (crypto.randomUUID for session IDs)
- A03:2021 — Injection (CSS sanitization in devtools)
- A05:2021 — Security Misconfiguration (minimal surface area, no bundled secrets)
- A06:2021 — Vulnerable and Outdated Components (regular npm audit, Socket.dev)
- A07:2021 — Identification and Authentication Failures (N/A — library, no auth)
- A08:2021 — Software and Data Integrity Failures (strict tsconfig, lock files)
- A09:2021 — Security Logging and Monitoring Failures (DevTools inspect, Logger module)
- A10:2021 — Server-Side Request Forgery (N/A — no network requests)

## Reporting Security Issues

If you find a security vulnerability:

1. Email [Dario Passariello](mailto:dariopassarielloa@gmail.com)
2. Or visit https://dario.passariello.ca/contact/

Do not open public issues for security vulnerabilities.

---
*Document version: 2.0 — Last updated: 2026-05-19*
*Owner: BigLogic Security Team*