Memory Vault

Security release — fixes from the M8 CodeQL pass. No API or behavioral changes; drop-in replacement for v1.0.1.

What's fixed

| CodeQL alert | Severity | File | Fix |
|---|---|---|---|
| alert 2 + 3 py/path-injection | High | src/api/app.py | New _safe_static_path helper |
| alert 1 py/stack-trace-exposure | Medium | src/api/routers/chat.py | Generic error message |

Path traversal in SPA fallback (High). The unauthenticated SPA fallback route accepted user-controlled paths and composed them with the static directory, allowing requests like GET /../../etc/passwd to escape. Fixed via _safe_static_path using os.path.commonpath + os.path.realpath plus pre-composition rejection of empty / null-byte / leading-slash / explicit-traversal inputs. Three independent layers of defense.

Information exposure in chat stream (Medium). The inner SSE error handler in /api/chat/stream interpolated raw exception text into the response. Fixed: server-side logger.exception(...), generic client message.

Out of scope

CodeQL flagged 3 partial-SSRF findings on the llm_url field in ChatRequest. These were dismissed as architectural — Memory Vault is single-tenant self-hosted with bearer-token auth; the llm_url field is intentional operator configuration. Hardening guidance for non-default deployments (publicly exposed cloud VMs, multi-user environments) is tracked in #18 for v1.1.

Full PR with test plan: #19.

Upgrade

docker compose pull
docker compose up -d

Or pin explicitly:

docker pull ghcr.io/mihaibuilds/memory-vault:1.0.2

170 tests passing in CI.