Skip to content
Memtru
Documentation menu
Security

Known limitations

This list is part of the product. If something here matters to you, it should shape how you read a PASS.

Test engine

  • Coverage is what the adapter exposes. Scenarios probe search and, where supported, read by id. Other retrieval paths in your system (exports, admin APIs, caches that the adapter does not go through) are not exercised.
  • Exact markers, not semantic queries. Fixtures are found by exact tokens. Retrieval with different natural-language queries may behave differently.
  • Timing. Deletion and update results hold for the configured consistency window only.
  • Deletion is about visibility, not physical erasure from backups, replicas, logs, embeddings or caches.
  • Agent mode has no built-in adapter. MT-POISON-007 is verified only against test doubles in this repository. Agent responses can be non-deterministic.
  • Timeouts cannot forcibly stop arbitrary blocking I/O. Cooperative containment blocks subsequent scenario operations and compensates late returned writes by exact id; reports retain a partial-cleanup warning. Writes whose response never returns require sandbox recovery. Custom adapters can perform internal work beyond this boundary.
  • Tenant isolation through http depends on how your service maps the context headers to identity. See Adapters.
  • External integrations. REST is verified against the reference server. The optional Mem0 OSS 2.2.1 adapter is verified with real local Qdrant and deterministic embedding/LLM substitutes; this does not verify hosted Mem0, real semantic embeddings, or application authentication. Read-by-id, session isolation, integrity and agent scenarios are not supported by this integration. See Adapters.
  • Not on PyPI. Install from the repository.

Web application

  • Controlled beta capacity. SQLite mode remains single-process with in-memory limits. Vercel uses Supabase PostgreSQL and shared rate limits; service transactions intentionally serialize through an advisory lock. A bounded hosted exercise measured report-upload p95 of 10.974 seconds at concurrency two, exceeding the exercise's eight-second stop threshold. It does not establish maximum capacity. Keep access controlled until latency is addressed; see Operations.
  • Account email and recovery. Public registration and email verification are implemented. Verification delivery requires both RESEND_API_KEY and MEMTRU_EMAIL_FROM; setting them does not itself prove inbox delivery. Automated password recovery and emailed invitations remain unavailable. Administrators can provision verified beta recipients with npm run admin:provision and reset passwords with npm run admin:reset-password; owners grant organization membership. Verify identity out of band. See Deployment.
  • Monitoring and recovery limits. Hourly GitHub Actions health checks can miss short outages or be delayed. Account notification delivery needs owner verification. The encrypted application-schema restore drill does not prove provider-wide recovery or off-device backup availability; provider retention, a separate-project restore, RPO and RTO still need verification. See Operations.
  • Windows development verification. The cross-platform browser-server startup fix is merged. Exact-revision Linux CI passed all 30 browser tests; an earlier isolated Windows run passed 28 with one long real-CLI flow timing out at 60 seconds. This local timing limit was not hidden or relaxed. Hosted functional evidence is recorded separately from local development checks.
  • No SSO, billing, or audit log viewer. Audit events are recorded but not shown in the UI.
  • Membership removal permanently revokes creator tokens for that organization. Existing sessions remain usable in other organizations, but every protected operation rechecks membership. Rejoining requires new tokens. Restoration from an old backup also restores old authorization state; reconcile revocations before reopening traffic.
  • runs:read scope is reserved. The CLI only uses runs:write.
  • Documentation pages render Markdown from the repository at request time, so a deployment must ship the docs/ directory.
  • Dependency risk. The development dependency braces@3.0.3 has an unpatched high-severity stack-exhaustion advisory, GHSA-vfj7-8cjw-p6xm. It is absent from the runtime dependency set; keep build/lint tooling isolated from untrusted patterns. Evidence is recorded in docs/audits/security-review.md in the private repository.
  • Upstream SDK warning. Qdrant client 1.19.1 opens an unclosed in-memory SQLite capability-probe connection; Python 3.14 emits a ResourceWarning. The allocation was traced to qdrant_client/local/persistence.py:80. Memtru closes the SDK history and actual vector-store client; vendor code was not patched or warnings suppressed.

Claims we do not make

Memtru is not a certification, does not establish regulatory compliance, and a passing run does not prove that a system cannot leak memory.