- XML tag validation: reject invalid tag names before regex construction
- API auth: optional bearer token (AGENTMEMORY_SECRET) on POST endpoints
- Conservative token estimation: length/3 for code-heavy content
- XML-escape project name in context output
- Prefix-only search matching (startsWith vs includes)
- Dynamic viewer URLs from window.location
- CSP header on viewer endpoint
- Importance class sanitization in viewer
- 45 tests: privacy, XML parsing, search index, schema
Rohit Ghumare