Remove internal security-audit files from public repo, fix README - #37
Open
sarveshsea wants to merge 1 commit into
Open
Remove internal security-audit files from public repo, fix README#37sarveshsea wants to merge 1 commit into
sarveshsea wants to merge 1 commit into
Conversation
Delete SECURITY_REVIEW/FIXES/SUMMARY/TEST_CASES/INDEX.md (internal vulnerability audit with exploit details and 20 personal absolute paths) and PRODUCT_SPEC.md (internal strategy). SECURITY.md policy stays. README: fix the broken Homebrew command (the tap ships only the memi-studio cask, no CLI formula), drop the maintainer publish-recovery runbook, absolutize relative links so they resolve on npmjs.com, fix the 404 codex-plugin link, and align the tagline with the approved positioning. Same positioning fix in llms.txt. package.json: drop @rollup/rollup-darwin-arm64 and -linux-x64-gnu from optionalDependencies; they are vite dev shims never imported by dist and only add install weight for consumers. Note: the deleted files remain in git history; a history scrub is a separate decision. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
This repo is public. It was carrying a full internal vulnerability audit — SECURITY_REVIEW.md (2 CRITICAL / 3 HIGH findings with vulnerable code excerpts), SECURITY_FIXES.md (exploit + bypass detail), SECURITY_TEST_CASES.md (PoC attacks), plus SUMMARY/INDEX — with ~20 absolute
/Users/…personal paths. PRODUCT_SPEC.md exposed internal strategy. All deleted; the public-facing SECURITY.md policy stays.README / packaging fixes
brew install sarveshsea/memi/memoirewas broken for every reader (the tap has no Formula, only thememi-studiocask) → replaced with the cask command and an honest notememoire.cv/codex-pluginlink@rollup/rollup-darwin-arm64/-linux-x64-gnufrom optionalDependencies — never imported bydist/, pure install weight (verified against the published 1.1.1 tarball)Follow-ups (not in this PR)
git filter-repo) + force push — owner's call.check_bridge_healthonly inspects its own in-process WS server (src/mcp/tools.ts:1074 → src/figma/ws-server.ts:408), so an externally-started bridge on 9223 is reported as down, and its return shape drops the documentedstatus/port/errorfields;memi connect --backgroundspawns a child that dies silently. Details in the session audit.🤖 Generated with Claude Code