Anonymous embed-widget visitors receive the instance owner's private Memories in the system prompt

Summary

On a single-user AnythingLLM instance with Personalization (Memories) enabled, the private memories the assistant has stored about the account owner are placed into the system prompt of every anonymous conversation with a public embed widget.

The embed chat handler passes the visitor-supplied username string into chatPrompt()'s user parameter, which expects a user record. user?.id is therefore undefined, and ?? null collapses it to null — which is not "no user", it is the exact scope key under which single-user-mode memories are written. The owner's rows are then appended verbatim to the system prompt under the heading ## Things I Remember About You.

The defect is deterministic and is what this report asks you to fix: confidential, owner-scoped data crosses into an unauthenticated request context on every single embed message. That happens in your code, server-side, before any model is involved — see the write/read convergence proof below, which is reproducible with node proof.js and nothing else.

Two things I want to be upfront about, so severity is judged on the right thing:

1. No live instance was run. This is static analysis of 3a85d3e7; I did not build the app, provision a database, or configure an LLM provider. Every claim below is a source-path claim, backed by exact file:line references and a dependency-free reproduction of the decisive expression.
2. I did not measure the final extraction step. Getting the…