← All docs

Security Policy

Supported Versions

We release security updates for the following versions:

Version Supported
1.x.x :white_check_mark:
< 1.0 :x:

Reporting a Vulnerability

Do not report security vulnerabilities in public. Mergen's source repository is private; there is no public issue tracker.

Email: security@mergen.app (monitored; falls back to hello@mergen.app)

Include:

  • Description of the vulnerability
  • Steps to reproduce
  • Potential impact
  • Suggested fix (if any)

We will respond within 48 hours and provide a timeline for a fix.

Security Model

Mergen is designed as a local-first development tool. All data stays on 127.0.0.1 (localhost).

Threat Model

In Scope:

  • Server vulnerabilities (RCE, injection, etc)
  • Extension vulnerabilities affecting host pages
  • Authentication/authorization issues
  • Data leakage to external systems

Out of Scope:

  • Local privilege escalation (Mergen runs with user privileges)
  • Physical access to machine
  • Browser vulnerabilities unrelated to Mergen
  • Social engineering attacks

Security Features

1. Localhost-Only Binding

The HTTP server binds to 127.0.0.1 only:

app.listen(port, '127.0.0.1');

Impact: Server is not reachable from other machines on the network or internet.

2. Ephemeral Loopback Token (Default Auth)

On every mergen-server start, a fresh 32-byte cryptographically-random token is written to ~/.mergen/loopback.token with mode 0o600 (owner-read only):

// sensor/loopback-token.ts
const token = crypto.randomBytes(32).toString('hex')
fs.writeFileSync(LOOPBACK_TOKEN_FILE, token, { encoding: 'utf8', mode: 0o600 })

All local clients (CLI, IDE companion) read this file and attach the value as x-mergen-loopback: <token> on every request. The server rejects requests missing a valid token with 401. The token is deleted on clean shutdown, so a stale token from a crashed run is invalid after the next restart.

Impact: Rogue local scripts and prompt-injected agents with only network access (but not filesystem read access) cannot forge requests to the gate API.

Disable with MERGEN_DISABLE_LOOPBACK_TOKEN=true for legacy clients.

3. Optional Shared-Secret Auth (Legacy / Team Mode)

MERGEN_SECRET=mysecret mergen-server start

All ingest requests must include x-mergen-secret: mysecret header.

Note: Prefer MERGEN_ADMIN_SECRET (env-only, never written to disk) over MERGEN_SECRET for privileged admin routes in team/production deployments.

4. SQLite Audit Files — Tightened Permissions

The SQLite event history (~/.mergen/history.db) and Agent Blunder Log (~/.mergen/agent-blunders.json) are written with mode 0o600 and the ~/.mergen/ directory is set to 0o700 on init:

fs.chmodSync(DATA_DIR,   0o700)  // directory: owner only
fs.chmodSync(HISTORY_DB, 0o600)  // file: owner read/write only

Impact: Reduces the surface area for same-user processes trivially reading or truncating audit logs. Combined with the HMAC-sealed Agent Blunder Log, any tampering attempt is both harder to execute and detectable after the fact.

5. Input Validation

All HTTP requests validated with Zod schemas:

const consoleEventSchema = z.object({
  type: z.literal('console'),
  level: z.enum(['log', 'info', 'warn', 'error']),
  args: z.array(z.any()),
  url: z.string(),
  timestamp: z.number()
});

Impact: Malformed requests rejected before processing.

4. Payload Size Limits

  • Max request size: 1MB
  • Max body field: 8KB (request/response bodies)
  • Max buffer: 200 events

Impact: Prevents memory exhaustion attacks.

5. Rate Limiting

Built-in rate limiting:

  • Burst: 100 requests
  • Sustained: ~1000 req/sec

Impact: Mitigates DoS attempts.

6. Extension Isolation

The browser extension:

  • Does not inject scripts into pages
  • Does not modify page behavior
  • Only captures console and network events
  • Fails silently on errors (never breaks host page)

Impact: Minimal attack surface, no impact on user's browsing.

7. No External Connections

Mergen makes zero external network connections:

  • No telemetry
  • No update checks (except opt-in via npx mergen-server@latest)
  • No analytics
  • No cloud services

Impact: No data exfiltration risk.

Best Practices

For Users

  1. Don't expose the server publicly:

    • Never bind to 0.0.0.0
    • Don't port-forward 3000-3010
    • Keep firewall enabled

  2. Don't log sensitive data:

    • Don't console.log() passwords, tokens, or PII
    • Review what your app logs before using Mergen

  3. Run server as unprivileged user:

    • Don't run as root/admin
    • Use standard user account

  4. Keep dependencies updated:

    cd server
npm update
npm audit

  5. Review extension permissions:

    • Extension only needs activeTab and storage permissions
    • Review code in extension/src/ before installing

For Developers

  1. Validate all inputs:

    • Use Zod schemas for all API endpoints
    • Sanitize user-provided data

  2. Avoid eval/Function:

    • Never use eval() on captured data
    • Don't execute user-provided code

  3. Limit buffer size:

    • Keep ring buffer capped at 200 events
    • Implement eviction policy

  4. Log security events:

    • Log failed auth attempts
    • Log malformed requests
    • Monitor for unusual patterns

  5. Run security scans:

    npm audit
npm run test

Known Security Considerations

1. Sensitive Data in Logs

Risk: Users may accidentally log passwords, tokens, or PII via console.log().

Mitigation:

  • Documentation warns against logging sensitive data
  • Users should review their app's logging before using Mergen
  • Consider implementing optional redaction rules

2. Local Privilege Escalation

Risk: If a malicious process runs as the same user, it could read Mergen's buffer.

Mitigation:

  • Data is in-memory only (not persisted to disk)
  • Buffer is cleared on server restart
  • Use OS-level security (firewall, antivirus)

3. Browser Extension Permissions

Risk: Extension has access to page content (console, network).

Mitigation:

  • Extension does not inject scripts
  • Extension does not modify pages
  • Source code is readable in extension/src/
  • Users can review before installing

4. MCP Protocol Security

Risk: MCP uses stdio, which is readable by processes with same privilege level.

Mitigation:

  • MCP is intended for local development only
  • Don't use Mergen in untrusted environments
  • IDE integration assumes IDE is trusted

Security Updates

We monitor dependencies for known vulnerabilities:

# Check for vulnerabilities
npm audit

# Auto-fix (when safe)
npm audit fix

Automated: GitHub Dependabot runs daily on the repository.

Disclosure Policy

When we fix a security issue:

  1. Patch released within 7 days (for critical issues)
  2. GitHub Security Advisory published
  3. CVE requested if severity warrants
  4. Users notified via GitHub release notes
  5. Full disclosure after 90 days (or when patch adoption >90%)

Security Contacts

Acknowledgments

We thank security researchers who responsibly disclose vulnerabilities. Contributors may be acknowledged in release notes (with permission).

References

Last Updated: 2026-05-14
Version: 1.0.0

Last updated July 27, 2026