Feng Ruohang
1f731549e4
Record RELEASE.2026-11-09T00-00-00Z (package 20261109000000.0.0) in the changelog: the fixes since 20261026, Console v2.7.0, mcli 20261109 and silo-pkg v3.16.0, upgrade notes and known issues. Point the README quick starts at the new image, replace the 20261026 release section with the 20261109 upgrade notice in both languages, refresh the contributor roll to 2026-11-09, and add a second security contact. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Feng Ruohang <rh@vonng.com>
3.0 KiB
Security Policy
Silo is an independent, community-maintained object-storage server derived from the open-source MinIO server. Upstream MinIO security contacts do not handle Silo-specific fixes or release notes.
Supported Versions
Security fixes are tracked on the active development branch and summarized in the security advisory ledger. Only the current Silo release line is supported unless an advisory says otherwise.
Inherited Fix Evidence
The canonical ledger also records security fixes inherited from upstream when they are part of the Silo release baseline. Source and fork commits are linked separately even when the fork preserves the original commit object and SHA.
- CVE-2025-62506:
upstream PR #21642 merged as
minio/minio@c1a49490, inherited unchanged aspgsty/silo@c1a49490, and is present in every Silo community release beginning withRELEASE.2025-12-03T12-00-00Z. The inherited service-account and STS regression groups remain part ofgo test ./cmd; see the canonical ledger for the operator-facing record.
Reporting a Vulnerability
The security contact for Silo is ron@pgsty.com. This address also receives automated security reports for this repository.
For vulnerabilities in this fork:
- Follow the fork-specific expectations in VULNERABILITY_REPORT.md.
- Prefer this repository's private GitHub security advisory workflow.
- If you cannot use GitHub private reporting, email ron@pgsty.com or rh@vonng.com directly. Do not publish vulnerability details or exploit code in public issues or pull requests.
- If you confirm the issue also affects upstream
minio/minio, report it upstream separately.
Scanner Configuration
The OSS Scanner build environment and scan scope and offline checks are maintained with the source. Update them when dependencies or security boundaries change.
Disclosure Process
Fork-specific fixes and user-visible upgrade notes are published in the security advisory ledger. The fork-specific triage and remediation process is described in VULNERABILITY_REPORT.md.