Security Policy
PGSTY SILO maintains active security tracking and patching for the S3-compatible object storage stack after upstream minio/minio entered archive mode. Current production deployments should run Server 20261026 (which retains the fixes first shipped in Server 20261018 for Object Lock advisories SN-2026-015 / SN-2026-016 and IAM Admin boundary SN-2026-017, building on SN-2026-011 through SN-2026-014 from Server 20260916), Console v2.5.1, and mcli 20261026; see the October Security Note, Advisory Ledger, and Component Matrix.
Note that deploying standalone Console does not replace an older Server’s embedded Console, and built-in policy Reset and immediate bucket-list refresh require the server-side fixes in Server 20261026 (not present in Server 20261018; see the Console 2.5.1 release notes).
Reporting a Vulnerability
Report undisclosed vulnerabilities through a private channel rather than a public issue:
- SILO Server, Console,
mcli, andsilo-pkg: Submit a private report via GitHub Security Advisories onpgsty/silo. - Documentation (
silo.pgsty.com): Open an issue onpgsty/silo.pgsty.com, or use the private advisory channel above if the report discloses an exploitable weakness.
Include the affected component version, reproduction steps, and impact scope. SILO is maintained as an open-source project on a best-effort basis without commercial response-time SLAs.
Upstream MinIO Vulnerabilities
Because SILO shares lineage with minio/minio, most vulnerabilities in inherited code affect both codebases. Report findings in inherited code directly to SILO; when a vulnerability affects other active distributions of the same lineage, we coordinate disclosure as appropriate.
Where Fixes Are Published
- Advisory Ledger: The canonical index of all
CVE-*andSN-2026-*identifiers, fix commits, affected versions, and dependency security updates. - Security Advisories: Technical advisories detailing root causes, exploit conditions, code fixes, and upgrade requirements.
- Release Notes: Versioned release announcements for Server, Console,
mcli, andsilo-pkg.
Deployment Hardening
- Security Checklist — production access control, network isolation, and key management.
- Network Encryption (TLS) — certificate configuration for S3, Console, and internode traffic.