OME MemoryGuard is an MVP policy and persistence layer. It reduces persistent-memory risk and adds Cognito JWT/group gates, but is not a complete IAM, DLP, secrets-scanning, or compliance product.

• persistent prompt injection and likely credential strings;
• cross-tenant/cross-namespace retrieval mistakes;
• expired, pending, denied, or over-classified memory retrieval;
• memory writes without paired audit evidence;
• accidental secret disclosure from Secrets Manager parsing;
• public or unencrypted evidence objects.

• denied raw content is not saved; metadata includes a one-way fingerprint;
• exact tenant/namespace/status/expiry/sensitivity filters precede vector ranking;
• request models bound identifiers, content, queries, and result limits before service/database work;
• creation and approval audit events are transactionally paired with memory mutations;
• Secrets Manager errors exclude connection-string contents;
• S3 evidence keys hash tenant identifiers and use encryption/checksum parameters;
• SAM IAM scopes secret, bucket prefix, and foundation model.
• protected AWS routes require API Gateway-verified Cognito JWTs;
• tenant/actor/clearance are server-derived in Cognito mode, and privileged actions require groups.

• add a production login UI, account lifecycle/recovery controls, and fine-grained scopes;
• verify group administration and token-revocation behavior in live integration tests;
• add policy versioning, revocation, retention, reconciliation, and tamper-evident audit chaining;
• add rate limits/WAF controls and structured logs with privacy review;
• run live integration, backup/restore, failure-injection, and authorization tests;
• review data residency, retention, legal, and incident-response requirements.

Never commit .env, credentials, tokens, connection strings, customer records, or exported evidence. Use .env.example only for variable names and placeholders. Routine checks should use DescribeSecret, not GetSecretValue, and must never print secret-bearing environment variables.

Use GitHub's private security advisory flow for the repository. Do not include a real secret or customer data in the report; provide a synthetic reproduction.