Mem0Sharp takes the security of the library and its users seriously. Thank you for reporting vulnerabilities responsibly.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Report vulnerabilities privately through GitHub Private Vulnerability Reporting.

Please include as much of the following information as possible:

• The affected package, component, or integration.
• The affected version, tag, or commit.
• Clear steps to reproduce the issue.
• The security impact and a proof of concept, if available.
• Any suggested mitigation or fix.
• Whether the issue depends on an external service such as PostgreSQL, pgvector, or an OpenAI-compatible model provider.

The maintainers will use the private advisory to investigate the report and coordinate any fix or disclosure with the reporter.

This policy covers security vulnerabilities in the Mem0Sharp source code, NuGet package, built-in storage and provider integrations, and repository configuration.

Mem0Sharp does not call the hosted Mem0 Platform API or depend on mem0.ai at runtime. Vulnerabilities in external services or deployments should also be reported to their respective maintainers, while including any Mem0Sharp-specific impact in the private report.

Do not include real API keys, passwords, connection strings, personal data, or production memory records in a report. Replace sensitive values with clearly identified placeholders and provide a minimal reproduction where possible.

Please reproduce reports against the latest published version when possible and include the exact version or commit used. Security fixes are evaluated against the currently maintained codebase; upgrade guidance will be included with any released fix when applicable.