Security audit
Membase
Security checks for vulnerabilities and agentic risk
Overview
The plugin’s memory access and storage match its stated purpose, with private-conversation safeguards enabled by default.
Use a personal gateway and a read-only, narrowly scoped key unless you want saves. Automatic recall sends message text to Membase; disable autoRecall if undesired. A configured container limits automatic recall, while key permissions should limit overall access. Keep shared-conversation access and automatic capture off unless intended. Delete saved content through the Membase app.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
No suspicious patterns detected.