// 2. Score relevance with context
const scored = await Promise.all(candidates.map(async (m) => {
const relevanceScore = await llm.complete(`
Rate 0-1 how relevant this memory is to the query.
Query: "${query}"
Memory: "${m.content}"
Return just the number.
`);
return { ...m, relevance: parseFloat(relevanceScore) };
}));
// 3. Filter low relevance
const relevant = scored.filter(m => m.relevance > 0.5);
// 4. Sort and limit
return relevant
.sort((a, b) => b.relevance - a.relevance)
.slice(0, maxResults);
}
Memories from one user accessible to another
Severity: CRITICAL
Situation: User sees information from another user's sessions
Symptoms:
User sees other user's information
Privacy complaints
Compliance violations
Why this breaks:
No user isolation in memory store.
Shared memory namespace.
Cross-user retrieval.
Recommended fix:
// Strict user isolation in memory
class IsolatedMemory {
private getKey(userId: string, memoryId: string): string {
// Namespace all keys by user
return user:${userId}:memory:${memoryId};
}
async add(userId: string, memory: Memory): Promise<void> {
// Validate userId is authenticated
if (!isValidUserId(userId)) {
throw new Error('Invalid user ID');
}
const key = this.getKey(userId, memory.id);
memory.userId = userId; // Tag with user
await this.store.set(key, memory);
}
async search(userId: string, query: string): Promise<Memory[]> {
// CRITICAL: Filter by user in query
return await this.store.search({
query,
filter: { userId: userId }, // Mandatory filter
limit: 10
});
}
async delete(userId: string, memoryId: string): Promise<void> {
const memory = await this.get(userId, memoryId);
// Verify ownership before delete
if (memory.userId !== userId) {
throw new Error('Access denied');
}
await this.store.delete(this.getKey(userId, memoryId));
}
// User data export (GDPR compliance)
async exportUserData(userId: string): Promise<Memory[]> {
return await this.store.getAll({ userId });
}
// User data deletion (GDPR compliance)
async deleteUserData(userId: string): Promise<void> {
const memories = await this.exportUserData(userId);
for (const m of memories) {
await this.store.delete(this.getKey(userId, m.id));
}
}
}
Validation Checks
No User Isolation in Memory
Severity: CRITICAL
Message: Memory operations without user isolation. Privacy vulnerability.
Fix action: Add userId to all memory operations, filter by user on retrieval
No Importance Filtering
Severity: WARNING
Message: Storing memories without importance filtering. May cause memory explosion.
Fix action: Score importance before storing, filter low-importance content
Memory Storage Without Retrieval
Severity: WARNING
Message: Storing memories but no retrieval logic. Memories won't be used.
Fix action: Implement memory retrieval and include in prompts
No Memory Cleanup
Severity: INFO
Message: No memory cleanup mechanism. Storage will grow unbounded.
Fix action: Implement consolidation and cleanup based on age/importance