Do not open a public issue. Email security disclosures to:

perseus@perseus.observer

You will receive a response within 48 hours. Perseus Computing LLC is a US-owned small business and treats security reports as confidential until a fix is published.

• Affected version(s) and build target (Linux, macOS, Windows)
• Steps to reproduce
• Impact assessment (what an attacker could do)
• Any suggested mitigations

1. Acknowledgment — within 48 hours
2. Triage — severity assessment within 5 business days
3. Fix development — timeline depends on severity
4. Coordinated disclosure — CVE assigned, fix released, advisory published

We support responsible disclosure and will credit reporters who follow this policy.

Maintainers: the internal process behind these commitments (handler roles, severity rubric, embargo and CVE handling) is documented in docs/vuln-response.md. For the full map of security documents, the access-privileges register, and the milestones that gate when we escalate security effort, see docs/SECURITY-INDEX.md and docs/SECURITY-MILESTONES.md.

Perseus Vault is a local-first MCP server that stores AI agent memory. It processes:

• Entity CRUD (remember, recall, search, forget)
• Journaling (append-only decision logs)
• State management (key-value with TTL)
• Optional embeddings (Ollama / ONNX Runtime)
• Optional connectors (GitHub issues, file watcher)

Perseus Vault supports AES-256-GCM encryption at rest for entity bodies. It is enabled by default for fresh installations: the first write to a new database generates an owner-only standard key (~/.perseus-vault/secret.key) and establishes the encrypted canary. Existing plaintext databases fail closed with an actionable init --rekey migration path (or an explicit PERSEUS_VAULT_ALLOW_PLAINTEXT=1 opt-out). See the full Encryption Specification and Threat Model for precise guarantees and limits.

Encryption is on by default for fresh installs — the standard key is auto-generated at ~/.perseus-vault/secret.key (0o600 on Unix) on first write. Explicit key management:

perseus-vault keygen                              # optional; fresh installs auto-create the standard key
perseus-vault --encryption-key ~/.perseus-vault/secret.key   # explicit key path

Existing plaintext databases fail closed with an init --rekey migration path (or explicit PERSEUS_VAULT_ALLOW_PLAINTEXT=1); doctor reports the actual on-disk state.

⚠️ Body encryption does not make the database file opaque. For keyword search to work, the FTS5 index (entities_fts) stores the body in plaintext, and metadata columns (category, key, tags, workspace, timestamps) are plaintext by design. To keep content unreadable from the file itself, also enable OS-level disk encryption (LUKS / FileVault / BitLocker). On Windows, Perseus Vault does not restrict the key file's ACL — do it yourself. Details in docs/ENCRYPTION.md.

• Perseus Vault runs on your machine. It does not phone home. No telemetry.
• MCP transport is local stdio by default. No network exposure unless you enable HTTP transport.
• Connectors are opt-in. GitHub and file watcher connectors are disabled by default.
• Encryption keys are your responsibility. Perseus Vault does not store, transmit, or escrow keys.

• 17 runtime dependencies — all MIT or Apache-2.0 licensed
• Zero copyleft (GPL/AGPL) — safe for government deployment
• SQLite bundled via rusqlite — no system library dependency
• SBOM published at docs/SBOM.md
• We monitor RustSec Advisory Database for crate CVEs
• cargo audit run in CI on every push

cargo audit --deny warnings runs on every push, every PR, and weekly against the live advisory database (.github/workflows/audit.yml). As of 2026-08-16 the scan reports 0 vulnerabilities across 438 locked dependencies. Two unmaintained advisories (informational severity — not exploitable vulnerabilities) are explicitly accepted, with justification, in that workflow:

Both chains were re-verified against crates.io on 2026-08-16: every crate in each chain is at its newest release and the newest releases still carry these crates, so there is currently no upgrade path that removes them. Any new advisory fails the CI gate immediately; if an upstream chain ever drops one of these crates, the corresponding ignore in .github/workflows/audit.yml is removed.

Release binaries carry signed SLSA build provenance (Sigstore-signed, via GitHub Artifact Attestations). After downloading a release archive you can verify it was built by our release workflow from this repository:

gh attestation verify perseus-vault-lite-x86_64-unknown-linux-musl.tar.gz \
  --repo Perseus-Computing-LLC/perseus-vault

A successful verification confirms the artifact's provenance (repo, workflow, commit) and that it has not been tampered with since it was built.

Security: perseus@perseus.observer

PGP — encrypt sensitive reports to our security key:

Fingerprint: 92C8 E815 1A60 DB38 46DB  420B 029A 35A6 A22B 287E

Fetch it from keys.openpgp.org (gpg --keyserver hkps://keys.openpgp.org --recv-keys 92C8E8151A60DB3846DB420B029A35A6A22B287E) and verify the fingerprint above before use.