diff --git a/SECURITY.md b/SECURITY.md index 1818991e9..44646202d 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,46 +1,41 @@ # Security Policy -## Project Status +## Supported Versions -Memos is currently in beta (v0.x). While we take security seriously, we are not yet ready for formal CVE assignments or coordinated disclosure programs. +Memos is currently a `0.x` project. Security fixes are only provided for the latest release. Older releases are not supported for security updates, and fixes are not backported. -## Reporting Security Issues +If you run Memos in production, keep your instance updated to the latest release. -### For All Security Concerns: -Please report via **email only**: dev@usememos.com +## Reporting a Vulnerability -**DO NOT open public GitHub issues for security vulnerabilities.** +Please report security issues privately by email: `dev@usememos.com` -Include in your report: -- Description of the issue +Do not open public GitHub issues, discussions, or pull requests for suspected vulnerabilities. + +Please include: + +- A clear description of the issue - Steps to reproduce -- Affected versions -- Your assessment of severity +- Affected version or commit +- Deployment details that matter to reproduction +- Your assessment of impact -### What to Expect: -- We will acknowledge your report as soon as we can -- Fixes will be included in regular releases without special security advisories -- No CVEs will be assigned during the beta phase -- Credit will be given in release notes if you wish +We will review reports as time permits and fix valid issues in regular releases. -### For Non-Security Bugs: -Use GitHub issues for functionality bugs, feature requests, and general questions. +## Disclosure and CVEs -## Philosophy +Memos is self-hosted software and is still in the `0.x` stage. At this stage, we do not run a formal disclosure program, publish separate security advisories for every issue, or request CVE IDs. -As a beta project, we prioritize: -1. **Rapid iteration** over lengthy disclosure timelines -2. **Quick patches** over formal security processes -3. **Transparency** about our beta status +Security fixes may be shipped directly in normal releases or noted briefly in release notes and changelogs. -We plan to implement formal vulnerability disclosure and CVE handling after reaching v1.0 stable. +## Self-Hosted Deployment Notes -## Self-Hosting Security +The security posture of a Memos instance depends heavily on how it is deployed and operated. In particular: -Since Memos is self-hosted software: -- Keep your instance updated to the latest release -- Don't expose your instance directly to the internet without authentication -- Use reverse proxies (nginx, Caddy) with rate limiting -- Review the deployment documentation for security best practices +- Keep Memos updated +- Put it behind a properly configured reverse proxy when exposed to the internet +- Require authentication for any non-public deployment +- Use TLS in production +- Limit access to trusted users and administrators -Thank you for helping improve Memos! +Reports that depend entirely on intentionally unsafe deployment choices, unsupported local patches, or administrator actions may be treated as deployment issues rather than product vulnerabilities. diff --git a/docs/issues/2026-03-31-quick-voice-input/definition.md b/docs/issues/2026-03-31-quick-voice-input/definition.md new file mode 100644 index 000000000..9c8b5cd22 --- /dev/null +++ b/docs/issues/2026-03-31-quick-voice-input/definition.md @@ -0,0 +1,47 @@ +## Background & Context + +Memos is a self-hosted note-taking product whose main write path is the React memo composer in `web/src/components/MemoEditor`. Memo content is stored as Markdown text, attachments are uploaded through the v1 attachment API, and the server already has dedicated file-serving behavior for media playback. The most recent relevant change in this area was commit `63a17d89`, which refactored audio attachment rendering into reusable playback components. That change improved how audio files are displayed after upload; it did not add a microphone-driven input path inside the compose flow. + +## Issue Statement + +Memo creation currently starts from typed text plus file upload and metadata pickers, while audio support in the product begins only after an audio file already exists as an attachment. Users who want to capture memo content by speaking must leave the compose flow to record elsewhere, then upload or manually transcribe the result, because the editor has no direct path from microphone input to memo text or an in-progress audio attachment. + +## Current State + +- `web/src/components/MemoEditor/index.tsx:26-154` assembles the compose flow from `EditorContent`, `EditorMetadata`, and `EditorToolbar`, and persists drafts through `memoService.save`. +- `web/src/components/MemoEditor/Editor/index.tsx:27-214` implements the editor surface as a `