Silo is a native desktop app that manages your Farming Simulator 25 mod library. We take its security seriously — it reads and writes files on your machine and talks to a handful of network services, so we want to hear about anything that could put users at risk.

Please do not open a public issue for a security vulnerability.

1. Preferred: use GitHub's private vulnerability reporting on HLLMR/silo (Security → Report a vulnerability). This keeps the report private between you and the maintainers until a fix is out.
2. If you can't use that, open a minimal public issue on HLLMR/silo that says only that you've found a security problem and asks for a private channel — without the details, proof-of-concept, or anything that would let others exploit it. A maintainer will get you somewhere private to share the specifics.

Please include, when you can: the Silo version, your OS, what the issue is, and the steps or a proof-of-concept to reproduce it. We'll acknowledge your report, keep you updated on the fix, and credit you when it ships (unless you'd rather stay anonymous).

In scope — the Silo desktop application in this repository:

• The Rust core (src-tauri/) and the Svelte frontend (src/).
• Local file handling: library scanning, projection (symlink/junction/copy), savegame backups, and any write into Documents/My Games/FarmingSimulator2025/. Path traversal, unsafe extraction, or a non-reversible write that could damage a user's game files are all in-scope concerns.
• Silo's outbound network calls. Silo talks to:
  • silo-api.hllmr.com — the SiloAPI catalog backend, for cross-source mod metadata.
  • GitHub, Nexus, and ModHub — reached through the user's own accounts and credentials (e.g. an OAuth token to star a GitHub repo, or endorse on Nexus). Silo brokers the action; it does not hold or proxy your credentials on any server of ours.

Generally out of scope:

• Vulnerabilities in FS25 itself, GIANTS software, GitHub, Nexus, or ModHub — report those to the respective vendor. (A flaw in how Silo interacts with them is in scope.)
• Issues that require a machine already compromised by a local attacker, or that depend on a malicious mod the user chose to install and run in the game.
• The SiloAPI server itself lives in a separate repository (HLLMR/silo-api) — report server-side issues there, but if you're unsure, send it here and we'll route it.

Silo has no analytics, no telemetry, and no account system — there is nothing to sign up for and nothing phones home about your usage. Its only outbound traffic is the catalog lookups to silo-api.hllmr.com and the per-source actions you explicitly trigger through your own GitHub / Nexus / ModHub credentials. This is intentional and part of the app's trust model; a change that quietly adds tracking or exfiltrates data would itself be treated as a security issue.

Silo is in public beta. Security fixes land on main and ship in the next release. Please test against the latest release or a current build from source before reporting.