Security

Memo is built for sharing pre-public content with a small number of high-trust individuals. The threat model assumes:

• The owner is trusted but their credentials may leak — so every action is audit-logged and the JWT is short-lived.
• Visitors are partially trusted (we asked them for an email) but may share the link — so we watermark, ratelimit, and record.
• Random internet traffic is hostile — scrapers, bots, headless browsers must not get past /<slug> without a UA that looks human.

Secrets#

Passwords#

Link passwords are stored as argon2id hashes:

hash = argon2id( pepper + ":" + salt + ":" + plaintext )

• salt is a fresh 16-byte hex string per links row.
• pepper is the env var MEMO_PASSWORD_PEPPER, never rotated.
• Argon2 params: timeCost=3, memoryCost=64MB, parallelism=1.

Salting + peppering means even if links.password_hash leaks, an attacker can't rainbow it without also having the pepper.

Visitor JWT#

See Visitor Gates for the full lifecycle. Key safety properties:

• HS256 signed by a key that lives only in Upstash Redis + the daily cron.
• Daily rotation via /api/cron/rotate-jwt-key; previous key kept for 48 h grace.
• Cookie is HttpOnly + Secure + SameSite=Lax, Max-Age=86400.
• Claims are bound to a single slug — a JWT for slug=A won't validate against loadLink('B') because no production code path mixes them, but defense-in-depth is on the roadmap.

Persistent-visitor cookie (memo_vp)#

Distinct from the gate JWT. Memo issues a second cookie to support cross-session attribution ("is this the 3rd visit by this browser?") without depending on email equality.

Threat model:

• No PII in the cookie value — the link to email happens server-side in memo.visits, not in the cookie.
• HttpOnly so JavaScript can't read or modify it (prevents document.cookie exfiltration via XSS in user-uploaded HTML).
• SameSite=Lax blocks the most common CSRF abuse vectors.
• Clearing browser cookies = new identity on next visit (a fresh memo_vp is minted, treated as a new browser). This is expected behaviour and is the privacy escape hatch for visitors.
• Spoofing risk: a visitor with another's memo_vp value (e.g. a stolen cookie jar) would be attributed to that browser's identity. Same risk profile as session cookie theft — mitigated by HttpOnly + Secure + the fact that the persistent ID alone doesn't grant access to anything (gate JWT is still required for content).

See Observability → Visitor identity model for the full two-cookie state-transition table and how return / share_detected signals exploit this for cohort detection.

CSP#

Two distinct policies, applied by src/middleware.ts:

Owner pages (/, /sign-in, /u/<username>/*, /api/owner/*):

X-Frame-Options: DENY

The base CSP is the Astro default with checkOrigin: true enforced by the framework — POST requests must come from a trusted origin.

Visitor pages (/<slug>/* — the public share surface at the root):

Content-Security-Policy:
  default-src 'self';
  script-src 'self' 'unsafe-inline'
             https://cdn.lr-ingest.io
             https://www.clarity.ms
             https://*.clarity.ms
             https://cdn.jsdelivr.net;
  style-src  'self' 'unsafe-inline';
  img-src    'self' data: blob:;
  font-src   'self' data:;
  connect-src 'self' https://*.lr-ingest.io https://*.clarity.ms;
  style-src-elem 'self' 'unsafe-inline' https://cdn.jsdelivr.net;
  frame-ancestors 'self';
  base-uri 'self';
  form-action 'self';
X-Frame-Options: SAMEORIGIN

'unsafe-inline' for script-src is necessary because the hosted HTML projects often embed inline <script> tags (it's the whole point — owners upload pre-built decks/demos). We accept the tradeoff because the rest of the policy is tight: scripts must come from same-origin or the whitelisted vendor CDNs (LogRocket, Clarity, and jsdelivr for the self-hosted rrweb loader), no iframes from other origins, no data: scripts, no form submissions to elsewhere.

Scraper blocklist#

scraperGate in src/middleware.ts runs only on visitor pages (/<slug>/* — anything not on /u/, /api/, /oauth/, /.well-known/, or another reserved root). It refuses any request with:

• Empty User-Agent
• UA matching /(curl|wget|httpie|python-requests|scrapy|bot|spider|crawler|headlesschrome|phantomjs|httrack|libwww-perl|java\/|ahrefsbot|semrushbot|mj12bot)/i

Refusal returns 404 Not Found with X-Robots-Tag: noindex,nofollow. Returning a 404 (rather than 403) avoids leaking that the slug exists.

Owner pages (/u/<username>/*) deliberately do not run this gate — Clerk handles bot traffic on the auth surface, and we don't want to lock out CLI tooling that owners might use.

Ratelimits#

All limiters are sliding-window via @upstash/ratelimit:

Crons (/api/cron/*) are not rate-limited because they are authorized by either a Bearer secret (Vercel native cron) or an Upstash-Signature header (QStash). Unauthorized requests return 401 Unauthorized regardless of rate.

Phase 1 hardening#

Security work that landed with the data-room surface (Spaces, Q&A, cloud OAuth). Each item is covered in depth on its feature page; summarized here for the threat model.

Secrets at rest#

• Provider OAuth tokens (Drive/Dropbox/Box) are AES-256-GCM encrypted before storage via the shared lib/crypto/secret-box.ts (also used by the webhook secret store). The *_encrypted columns now hold ciphertext (iv:tag:ct); the GCM tag makes tampering detectable. Key: PROVIDER_TOKEN_ENCRYPTION_KEY (falls back to WEBHOOK_ENCRYPTION_KEY). Tokens are never logged. See Integrations.

OAuth callback (CSRF / connection-fixation)#

• The /api/oauth/<provider>/callback nonce is mandatory and single-use; the owner identity is read from the server-side Redis entry, never from the attacker-decodable state. PKCE S256 is added on the outbound flow. The provider is allowlisted (no SSRF), and the post-auth redirect is hardcoded first-party (no open redirect). See Integrations.

Access-control#

• Visitor/space JWTs are slug-bound — a token for slug A is rejected on slug B (defense beyond per-slug cookie naming). See Visitor Gates → Slug binding.
• Space reorder IDOR (fixed) — PUT /api/owner/spaces/<id>/projects now requires the supplied set to equal existing membership (reorder-only); attaching is POST-only and validates projects.owner_id = caller. See Spaces → Security notes.
• Every /api/owner/* route is authenticated (withOwner) and every [id] route re-confirms ownership before read/mutate — verified across the new spaces/teams/diligence/qa routes. The static nda-templates route was wrapped in withOwner to match the convention.
• Public Q&A submit is rate-limited + zod-validated (above); the GET is scoped to the asking visit. The widget escapes all server data (no XSS). See Q&A.
• Space NDA signatures write signatures.space_id (not the links-FK link_id) to avoid a FK-violation crash. See Visitor Gates → NDA signing.

Audit log#

Every state-changing endpoint writes a row to memo.audit_logs via src/lib/security/audit.ts. Current coverage:

The audit() helper swallows errors so a Postgres outage on the log table never breaks a user flow. Tradeoff: a brief outage may lose entries. The alternative — failing the parent request — is worse for this product.

Threat-model coverage matrix#

v2 — Machine access#

Memo's machine surface (/api/mcp + the OAuth endpoints) inherits all of the above and layers on a few new concerns.

Audit log expansion#

Every state-changing MCP tool writes an audit_logs row with meta.actor set to either mcp_pat:<token_id> or mcp_oauth:<access_token_id>. To find every change a specific OAuth connection made:

SELECT ts, action, target_type, target_id, meta
FROM memo.audit_logs
WHERE meta->>'actor' = 'mcp_oauth:<access_token_id>'
ORDER BY ts DESC;

OAuth-flow actions also write their own rows:

What's not in scope (v1)#

• Per-link CNAME (custom domain) — v3.
• White-label theming via runtime :root overrides — schema supports it; admin UI deferred.
• TOTP / WebAuthn for owners — Clerk handles MFA upstream.
• Bring-your-own-key encryption for project files at rest — R2 + Cloudflare handle encryption at rest.
• Server-side malware scanning on uploaded HTML — out of scope; the threat model assumes owners control their own content.