Currently supporting security updates for:

Please do not report security vulnerabilities through public GitHub issues.

1. Email: Send details to the project maintainer (contact info in README)
2. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 5 business days
• Updates: Weekly until resolved
• Fix Timeline: Critical issues within 7 days, others within 30 days

• We request 90 days before public disclosure
• We'll credit you in the security advisory (unless you prefer anonymity)
• We may offer recognition in CONTRIBUTORS.md

1. Keep Updated: Always use the latest version
2. Secure Configuration:
   • Set strong CONTINUUM_SECRET_KEY
   • Restrict CONTINUUM_CORS_ORIGINS
   • Enable CONTINUUM_REQUIRE_API_KEY=true
3. Environment Secrets:
   • Never commit .env files
   • Use secrets management in production
   • Rotate API keys quarterly
4. Network Security:
   • Deploy behind HTTPS
   • Use firewall rules
   • Implement rate limiting

1. Code Review: All security-sensitive changes require review
2. Testing: Run security tests before merging
3. Dependencies: Keep dependencies updated
4. Static Analysis: Run bandit and safety checks

• ✅ Parameterized SQL queries (SQL injection protection)
• ✅ PBKDF2 API key hashing (100k iterations)
• ✅ Multi-tenant data isolation
• ✅ Input validation (Pydantic schemas)
• ✅ CORS configuration
• ✅ Rate limiting (stub - Redis recommended)
• ✅ Message signing (federation)
• ✅ TLS/HTTPS support

• ⏳ Admin role-based access control (Q1 2026)
• ⏳ WebSocket authentication (Q1 2026)
• ⏳ Database encryption at rest (Q2 2026)
• ⏳ Audit logging (Q2 2026)
• ⏳ Intrusion detection (Q3 2026)

Last comprehensive audit: 2025-12-06

Full audit report: docs/SECURITY_AUDIT.md

• Critical: 2 (fixed)
• High: 4 (2 fixed, 2 planned)
• Medium: 4 (documented)
• Low: 2 (informational)

We appreciate security researchers who responsibly disclose vulnerabilities. We commit to:

1. Prompt acknowledgment
2. Transparent communication
3. Timely fixes
4. Public credit (with permission)

• Primary: Project maintainer (see README)
• Response Time: 48 hours
• PGP Key: Available on request

CONTINUUM handles potentially sensitive AI memory data. Consider these security practices:

# Data stored locally - you control access
memory = Continuum(storage_path="./secure_data")

Best Practices:

• Store database files on encrypted filesystems
• Set restrictive file permissions (0600)
• Avoid storing sensitive data in cleartext

# Enable encryption for sensitive deployments
from continuum import Continuum

encryption_key = os.environ.get('CONTINUUM_ENCRYPTION_KEY')  # 32-byte key
memory = Continuum(
    storage_path="./data",
    encryption_key=encryption_key.encode()
)

Key Management:

• Store keys in environment variables or key management systems
• Never commit keys to version control
• Rotate keys periodically
• Use different keys for different environments

Ensure SQLite database files have restrictive permissions:

# Set permissions after creation
chmod 600 ./data/continuum.db

# Verify
ls -la ./data/continuum.db
# Should show: -rw------- (owner read/write only)

When using PostgreSQL in production:

# Use TLS/SSL connections
memory = Continuum(
    storage_backend="postgresql",
    connection_string="postgresql://user:pass@localhost/db?sslmode=require"
)

Best Practices:

• Always use sslmode=require or sslmode=verify-full
• Use strong passwords (minimum 20 characters)
• Restrict database access by IP (pg_hba.conf)
• Enable PostgreSQL audit logging
• Regular security updates

When coordinating across network:

# Secure coordination (future feature)
memory = Continuum(
    coordination_url="https://coord.example.com",
    api_key=os.environ.get('CONTINUUM_API_KEY'),
    tls_verify=True
)

Best Practices:

• Use HTTPS for all network communication
• Authenticate instances with API keys or certificates
• Rate limit sync requests
• Monitor for unusual sync patterns

CONTINUUM sanitizes inputs, but be aware:

# Extremely long inputs are rejected
try:
    memory.learn("A" * 10_000_000)  # Will raise ValidationError
except ValidationError:
    pass

All queries use parameterized statements:

# Safe - parameters are escaped
memory.recall("user's input with 'quotes'")

# Internal implementation uses:
cursor.execute("SELECT * FROM concepts WHERE name LIKE ?", (query,))

Storage paths are validated:

# Dangerous - rejected
memory = Continuum(storage_path="../../etc/passwd")  # ValidationError

# Safe - contained within allowed directory
memory = Continuum(storage_path="./data")

CONTINUUM v0.1 has no built-in authentication. Security model:

• File system permissions control access
• Process isolation separates instances
• No network API in default configuration

REST API will include:

• API key authentication for service mode
• Role-based access control for multi-tenant deployments
• Audit logging of all operations
• Rate limiting to prevent abuse

We use:

• Dependabot - Automatic dependency updates
• pip-audit - Python package vulnerability scanning
• Safety - Check known security vulnerabilities

# Check for known vulnerabilities
pip-audit

# Update dependencies
pip install --upgrade continuum-memory

# BAD - hardcoded credentials
memory = Continuum(
    connection_string="postgresql://admin:password123@localhost/db"
)

# GOOD - environment variables
memory = Continuum(
    connection_string=os.environ.get('DATABASE_URL')
)

# Don't expose internal details in errors
try:
    memory.recall("query")
except Exception as e:
    # BAD: log.error(f"Database error: {e}")  # Might expose structure
    log.error("Query failed")  # GOOD: Generic message
    raise ContinuumError("Query failed") from e

CONTINUUM uses secure defaults:

• SQLite databases created with 0600 permissions
• Connections time out after 30 seconds
• Query limits prevent resource exhaustion
• Auto-optimize prevents unbounded growth

• ✅ Parameterized SQL queries (SQL injection protection)
• ✅ Input validation and sanitization
• ✅ Path traversal protection
• ✅ Restrictive file permissions
• ✅ Optional encryption at rest
• ✅ Resource limits (query size, text length)
• ✅ Transaction isolation (ACID compliance)

• 🔄 API key authentication
• 🔄 Role-based access control (RBAC)
• 🔄 Audit logging
• 🔄 Rate limiting
• 🔄 TLS/SSL for all network communication
• 🔄 Secrets management integration (Vault, etc.)
• 🔄 Two-factor authentication (2FA)

Data Confidentiality:

• Unauthorized access to knowledge graph
• Interception of sync traffic (PostgreSQL backend)
• Exposure of sensitive concepts/entities

Data Integrity:

• Tampering with stored knowledge
• SQL injection attacks
• Malicious input corruption

Availability:

• Resource exhaustion (DoS)
• Database corruption
• Sync failures causing data loss

• Physical access to server
• Compromised host operating system
• Side-channel attacks
• Attacks requiring root/admin privileges
• Social engineering

• All inputs validated
• Parameterized queries used
• No secrets in code
• Error messages don't leak sensitive info
• Dependencies scanned for vulnerabilities
• Code reviewed for security issues

• Database files have 0600 permissions
• Encryption enabled for sensitive data
• TLS/SSL used for PostgreSQL connections
• Environment variables used for secrets
• Regular backups configured
• Logs monitored for suspicious activity
• Security updates applied promptly

• Access logs reviewed regularly
• Dependency updates automated
• Incident response plan in place
• Regular security audits scheduled
• Backup restoration tested
• Key rotation scheduled

1. T+0: Vulnerability reported
2. T+48h: Acknowledgment sent to reporter
3. T+5d: Initial assessment and severity rating
4. T+30d: Fix developed and tested (critical issues)
5. T+90d: Fix developed and tested (non-critical issues)
6. T+Fix: Security advisory published
7. T+Fix+7d: Public disclosure (coordinated with reporter)

import os
from continuum import Continuum

# Use environment variables for sensitive config
memory = Continuum(
    storage_path=os.environ.get('CONTINUUM_DATA_PATH', './data'),
    encryption_key=os.environ.get('CONTINUUM_ENCRYPTION_KEY'),
)

# Set restrictive permissions
import os
os.chmod('./data/continuum.db', 0o600)

import os
from continuum import Continuum

memory = Continuum(
    storage_backend="postgresql",
    connection_string=os.environ.get('DATABASE_URL'),  # Uses TLS
    instance_id=f"production-{os.environ.get('HOSTNAME')}",
    encryption_key=os.environ.get('CONTINUUM_ENCRYPTION_KEY')
)

# Enable audit logging
import logging
logging.basicConfig(
    filename='/var/log/continuum/audit.log',
    level=logging.INFO,
    format='%(asctime)s - %(name)s - %(levelname)s - %(message)s'
)

# Periodic backups
import shutil
from datetime import datetime

def backup_memory():
    timestamp = datetime.now().strftime('%Y%m%d_%H%M%S')
    backup_path = f"./backups/continuum_{timestamp}.db"
    memory.backup(backup_path)

    # Verify backup
    backup_memory = Continuum(storage_path=backup_path)
    assert backup_memory.get_stats()['concepts'] > 0
    backup_memory.close()

# Run weekly
import schedule
schedule.every().week.do(backup_memory)

Security Team: security@continuum-project.org

PGP Key: [Coming Soon]

Response Time: 48 hours for acknowledgment

Security is everyone's responsibility. Report vulnerabilities responsibly.