MemBox code review: a polished memory API with unlocked dashboard doors

DEEP PROJECT REVIEW · SOURCE + LIVE PREVIEW

The Vercel preview looks ready for customers: type a name, get an endpoint, upload files, hand an agent a bearer token. Behind that tidy page sits a much bigger repository: 11079 lines of TypeScript/TSX, 22 API route files, five UI languages, two storage modes, share links, snapshots, webhooks, analytics, batch calls, TTL, full-text search and a GitHub “brain.” Then the review reaches the dashboard routes. Several hand back private box records or delete boxes without checking who is asking. That one finding rewrites the verdict.

How it is put together

A Next.js 16 app serves the landing page and route handlers. Prisma stores users, boxes, share tokens, snapshots, TTL entries, webhooks, and analytics in SQLite. File bodies live on the local filesystem or in GitHub through the Contents API. A paired user can supply a fine-grained PAT; AES-256-GCM protects it when `APP_SECRET` is strong. A central repository also carries database checkpoints, share mirrors, and pairing records so serverless instances can recover state.

What it can do

The memory API supports text or JSON upsert, append, read, list, delete, multipart uploads, binary downloads, content/name search, batches, expiring entries, snapshots and restore, read/write share tokens, event webhooks, and usage analytics. The dashboard adds registration, token login, a file browser, GitHub pairing and repository exploration. The interface is translated into English, Russian, Georgian, Arabic, and Hebrew.

Where access control holds, and where it does not

The agent-facing `/api/m/...` routes generally require a box or valid share token and distinguish read from write. Path cleanup strips repeated dots; GitHub keys use a strict allowlist; search skips symlinks and checks containment. Those are good controls. But dashboard routes under `/api/boxes` are inconsistent. Anyone who knows or discovers a username can list that user’s boxes, including each plaintext master token. `GET /api/boxes/[slug]` returns the full record and files without authentication. The corresponding `DELETE` removes the box without authentication. File listing and text preview also lack authentication. These are critical broken-access-control paths, not polish issues.

A bearer-token boundary is only as strong as its least protected route, and here the dashboard endpoints walk around it.

Data and platform risks

Tokens are random 32-byte values, but database fields hold them directly rather than hashes. Query-string token support can leak through history and logs. Webhook destinations accept any valid URL and are later fetched by the server, with no private-network block in the reviewed code. That creates SSRF risk. The in-memory rate limiter is per process, so it does not provide a global limit across serverless instances.

What the docs promise and what the code does

The README and UI say 1 MB free storage and uploads up to 500 MB. The reviewed multipart path reads the complete file into a Buffer and writes it without checking either cap. Platform limits may reject large requests, but that is not the product enforcement described. The primary `membox.space-z.ai` URL currently shows “Project expired and recycled.” The Vercel preview works, but its README explicitly calls stored data ephemeral.

Does it build, lint and test?

`npm run build` succeeds, while Next.js warns that dynamic filesystem access can trace the entire project into route bundles. `npm run lint` fails with six React rule errors. The repository has a deployment workflow but no checked-in automated test suite. A current production-dependency audit reports nine advisories: five high and four moderate. These are reproducible quality signals, not a claim that every advisory is exploitable here.

How it looks and reads

The live preview has a convincing dark visual system: sharp white type, one emerald accent, restrained glows, a direct username field, and a feature story that gets from “why” to REST mechanics quickly. RTL works at the product level. The copy is less disciplined: “No limits” conflicts with “1 MB free,” and the interface promises 500 MB uploads without matching enforcement. A technical product should make operating limits as precise as its API examples.

What to fix first

First, put every dashboard route behind a session or require the login token, and never serialize master tokens in list responses. Hash login and box tokens; show secrets once and rotate them. Apply storage and upload limits before reading bodies into memory. Block loopback, link-local, and private IP ranges for webhooks; sign webhook payloads. Move rate limits to a shared store. Add authorization integration tests for every route, then make lint and tests required in CI.

Verdict

MemBox has a strong product shape: universal REST, path-based files, search, snapshots, share permissions, TTL, webhooks, analytics, multilingual UI, and optional GitHub persistence. Its preview is one of the more polished agent-memory demos in this series. It is not safe for important data in the reviewed state because the dashboard API bypasses its own token boundary. Fix authorization first; performance and growth come later.

Project links and credit

Working Vercel preview · Primary demo (expired when checked) · Source

Reviewed source at commit e8e53b5 · Build and audit reproduced 2026-09-21