Security Policy
PGSTY SILO maintains active security tracking and patching for the S3-compatible object storage stack after upstream minio/minio entered archive mode. Production deployments should run Server 20261109, embedded and standalone Console v2.7.0, mcli 20261109, silo-pkg v3.16.0, and optional external KES 20261026, all built with Go 1.27.3.
Server 20261109 embeds Console v2.7.0 and enforces Object Lock on replicated deletes, directory null-version bulk deletes, and concurrent S3 DeleteObjects version purges, alongside submitter-bound batch job authorization, stored-record IAM mutations, incomplete-policy-load refusal, external authorization plugin bounds, and heal dry-run data preservation. It retains all earlier security repairs, including SN-2026-015 through SN-2026-017 from Server 20261018 and SN-2026-011 through SN-2026-014 from Server 20260916. Review the 20261109 upgrade requirements, Advisory Ledger, and Component Matrix before upgrading.
Deploying standalone Console or mcli does not replace components embedded in an older Server binary; Server-side authorization, lifecycle, and Object Lock fixes require upgrading SILO Server.
Reporting a Vulnerability
Report undisclosed vulnerabilities through a private channel rather than a public issue:
- SILO Server, Console,
mcli,silo-pkg, andkes: Submit a private report via GitHub Security Advisories onpgsty/silo. If GitHub private vulnerability reporting is unavailable, email ron@pgsty.com or rh@vonng.com. - Documentation (
silo.pgsty.com): Open an issue onpgsty/silo.pgsty.com, or use the private advisory channel above if the report discloses an exploitable weakness.
Include the affected component version, reproduction steps, and impact scope. SILO is maintained as an open-source project on a best-effort basis without commercial response-time SLAs.
Upstream MinIO Vulnerabilities
Because SILO shares lineage with minio/minio, most vulnerabilities in inherited code affect both codebases. Report findings in inherited code directly to SILO; when a vulnerability affects other active distributions of the same lineage, we coordinate disclosure as appropriate.
Where Fixes Are Published
- Advisory Ledger: The canonical index of all
CVE-*andSN-2026-*identifiers, fix commits, affected versions, and dependency security updates. - Security Advisories: Technical advisories detailing root causes, exploit conditions, code fixes, and upgrade requirements.
- Release Notes: Versioned release announcements for Server, Console,
mcli,silo-pkg, andkes.
Deployment Hardening
- Security Checklist — production access control, network isolation, and key management.
- Network Encryption (TLS) — certificate configuration for S3, Console, and internode traffic.