Only the latest release on the main branch receives security fixes during the research prototype phase.

Do not open a public issue for a vulnerability. Use GitHub private vulnerability reporting when it is enabled for the repository. Include the affected revision, a minimal reproduction, impact, and any suggested mitigation.

Do not include API keys, database credentials, private memory payloads, or personal data.

The local development key is not a production secret. Replace it with credentials loaded from a secret manager. Use TLS, explicit allowed origins, least-privilege operation policies, database backups, and restricted access to traces and audit exports.

TxnMem treats memory text as untrusted data. It never executes memory content as a database query, policy rule, or shell command.