A source-pinned review of how Silo Explorer handles local files, search and indexing, location data, connected Google accounts, payments, clipboard access, and network traffic.
The reviewed code processes search and media indexing locally and does not show a routine background upload of the user’s files. Silo still makes network requests for map services, optional Google features, user-submitted reports, app updates, and license verification. Some of those requests disclose sensitive context such as precise photo coordinates or Google account data.
The Electron window disables Node integration and enables context isolation and sandboxing. The semantic worker disables remote model downloads. Crash uploads are off. Payment and report relays require HTTPS except for explicitly local development endpoints.
The locked Electron runtime is 37.10.3, which the dependency audit flags with multiple advisories. Production dependencies also include vulnerable versions of native image and model-processing packages. The optional Google connector stores OAuth tokens in a local JSON file without app-level encryption.
These are the outbound paths found in the repository. Several are user-triggered or require an enabled integration; the code review did not find a general file-sync or telemetry upload loop.
Silo sends the cluster’s latitude and longitude to OpenStreetMap Nominatim. The local cache key rounds coordinates, but the request uses the original values. Place-name searches send the typed query to Photon/Komoot. Zoomed satellite-map tiles go to Esri/ArcGIS with tile coordinates. These providers can infer the searched place or approximate map viewport.
Drive browsing and file operations go to Google Drive; Photos selection uses Google Photos Picker; Gmail reclaim features access Gmail. OAuth asks for full Drive access, Photos Picker media-item read access, and Gmail modify access. This cloud workflow transfers the selected Google data to Silo locally and may upload chosen local files to Drive when requested.
The report relay receives the written message, selected feature label, optional screenshot, app version, platform, and timestamp. The screenshot is captured only through a separate request from the report UI. Electron’s crash reporter is configured with uploads disabled.
The HTTPS license relay receives an installation ID, payment method and optional payment reference; verification later includes a transaction signature and claim token. The Solana payment itself is public ledger data. The client contains public-key verification for signed entitlements, but the relay service implementation is not in this repository.
Silo queries GitHub Releases for release metadata and downloads the selected app update from the project’s release hosting. The reviewed update request is not a user-file upload.
Silo serves only the selected share set from a private IPv4 interface. The bearer URL contains a random 32-byte token and uses plain HTTP on the local network. The server checks that a requester is on the same subnet and sends no-store, no-referrer, CSP, and frame-blocking headers. Anyone who obtains the URL on that LAN can access the shared selection while the share remains active.
The worker points Transformers to the local model cache and sets allowRemoteModels = false. It reads supported local files to generate embeddings; the record schema stores paths, names, source paths, metadata, signatures and vector offsets, while vectors are stored in vectors.bin. The inspected index record does not contain the full file text.
Face records contain image paths, face descriptors and crop paths. Geolocation cache entries contain image paths and location data, including latitude and longitude. These remain local application data in the reviewed code, but no app-level encryption was found for these indexes.
The lockfile resolves Electron to 37.10.3. The full dependency audit flags Electron with multiple advisories, including high-severity issues; examples include sandbox and renderer-boundary behavior fixed in later Electron release lines. Electron is listed as a development dependency because it is the packaging/runtime framework, so it still becomes the app runtime. This is a clear release-maintenance issue. The exact exploitability of each advisory depends on whether the affected Electron feature is reachable in Silo.
Evidence: package.json; Electron advisory; Electron advisory.
npm audit --omit=dev reported 13 affected production package entries: 7 high and 6 moderate, with no critical entries. The lockfile includes sharp 0.34.5, onnxruntime-node 1.24.3, and adm-zip 0.5.18, among others. Advisories include image decoder issues and archive extraction/resource-exhaustion risks. These counts are advisory matches, not proof that Silo is exploitable; exposure depends on whether affected parsing paths receive attacker-controlled files or archives.
Evidence: pinned package-lock.json; sharp / libvips advisory; adm-zip advisory.
Access and refresh tokens are serialized to google-accounts.json under Silo’s user-data directory. The write requests mode 0600 for a new file, which is a useful filesystem restriction, but no OS keychain encryption is present in this code path. A process running as the same user may still be able to read the token. Also, a Google client secret is optionally packaged inside google.env; for a desktop app, that value is extractable and should not be treated as a secret boundary. PKCE and OAuth state checks are present and are positive controls.
Evidence: OAuth PKCE and token flow; account storage path; token persistence; bundled OAuth resource.
When a selected photo cluster has no city, region or country label, Silo requests reverse geocoding. The local key is rounded to four decimal places, but the HTTP request sends the unrounded latitude and longitude. A typed location search is also sent to Photon, and satellite tiles load from Esri/ArcGIS. This is a meaningful privacy disclosure for location-sensitive photos, even though it is user-driven.
Evidence: place search; reverse geocoding request; cluster selection trigger; satellite tile provider.
The optional connector requests full Drive scope, Photos Picker read access, and Gmail modify scope. Gmail modify is broader than just moving a selected message to Trash. The reclaim flow does save checksum-verified local copies before moving chosen items to Google Trash, and the Drive “Delete forever” action has a separate confirmation. However, that action empties the entire connected Drive trash, so the confirmation and permission explanation deserve especially clear wording.
Evidence: OAuth scopes; verified-copy, trash and permanent-empty behavior; confirmation UI.
The 32-byte random token, private-interface binding, same-subnet check and no-store/no-referrer headers are meaningful safeguards. HTTP still does not encrypt the URL or shared media on the local network; anyone who obtains the URL while sharing is active may access the selected files. Treat the link like a password and use it only on a trusted network.
Evidence: private LAN selection and subnet gate; response headers; HTTP bearer URL; random token and listener.
Node integration is off; context isolation and sandboxing are on; external new windows are restricted by an allowlist. The packaged renderer HTML has no Content Security Policy, and this snapshot has no will-navigate handler. This is not a demonstrated exploit. A restrictive CSP and an explicit navigation allowlist would reduce the impact of a future renderer injection bug.
Evidence: Electron window and new-window policy; renderer HTML; Electron security guidance.
The UI asks for 25 USDC on Solana and opens a Solana Pay URI in the user’s wallet. The inspected Silo code does not handle a wallet private key. Relay traffic is HTTPS; purchase verification binds the result to an installation ID; locally stored lifetime tokens are checked against an embedded public key and the expected device ID. Keep the transaction signature: it is public on-chain and is sent to the relay when a user verifies payment.
The license relay backend is not included in the reviewed commit. Its transaction validation, signing-key protection, logs, retention policy, abuse controls and incident response cannot be assessed from this repository. Client checks cannot establish how the service handles the data it receives.
The source writes the public payment address and active LAN share URL to the clipboard when the user selects Copy. A share URL contains its bearer token, so the clipboard becomes sensitive until cleared or replaced. No clipboard read operation was found in the reviewed Silo source.
CrashReporter upload is disabled. A bug report is a separate user action and can include a screenshot of the current app window. Users should review the screenshot and message for visible names, file paths or personal content before submitting.
Evidence: HTTPS relay enforcement; purchase metadata sent to relay; signature verification and device binding; local signature verification; payment-address clipboard write; share-link clipboard write; crash uploads disabled.
| Scope checked | Audit output | Interpretation |
|---|---|---|
| Production dependency graph | 13 entries 7 high · 6 moderate · 0 critical | Includes shipped media/model dependencies such as sharp, onnxruntime-node and adm-zip. Prioritize upgrades and verify actual parser exposure. |
| Full lockfile graph | 129 entries 3 critical · 84 high · 39 moderate · 3 low | Includes Electron runtime and development/build tooling. Counts are package-level npm audit findings, not unique CVEs or confirmed exploitable flaws. |
The Electron runtime finding deserves separate attention from the app’s production-only dependency count. The full graph also includes critical findings in build-time packages such as tar, shell-quote and proxy-addr; these are not automatically shipped to end users, but they can matter to developer machines and CI when processing untrusted inputs. Pin and update the toolchain with regression coverage rather than applying broad force-fixes.
Reviewed build workflows request contents: read, a restrictive baseline. GitHub Actions are referenced by mutable major-version tags such as @v4 and @v2, not full commit SHAs. Pinning to verified SHAs would make builds more resistant to a compromised or retargeted action tag.
GitHub metadata observed during this audit reported Dependabot security updates and secret scanning as disabled. That can delay notification of vulnerable dependencies or accidentally committed secrets. Re-check these settings before finalizing this public review.
Evidence: declared dependencies and Electron version; locked dependency versions; macOS build permissions and actions; GitHub guidance on pinning third-party actions; npm audit documentation.
Upgrade Electron to a patched supported release. Re-run the full lockfile audit and test the permission, navigation, update and native-addon flows on macOS and Windows.
Patch production dependencies. Focus on sharp, ONNX Runtime, archive handling and document parsers; confirm whether each vulnerable code path receives untrusted files or archives.
Move OAuth tokens into platform secure storage. Keep refresh tokens out of plaintext JSON where possible, and treat a desktop OAuth client secret as public. Retain PKCE and the state check.
Explain Google scopes at the point of connection. Call out full Drive access, Gmail modification and the separately confirmed “Delete forever” action that clears the connected Drive trash.
Make map disclosures explicit. Explain that exact photo coordinates may be sent to geocoding providers; consider an opt-out or a coarser-coordinate mode.
Strengthen the share boundary. Keep the trusted-network warning prominent, show an expiry or stop-sharing control, and evaluate encryption for LAN traffic.
Add renderer CSP and navigation policy. Keep the existing sandbox and isolation settings, then verify the policy against the production renderer and bundled assets.
Harden the build chain. Pin third-party GitHub Actions to full SHAs and enable Dependabot alerts/updates and secret scanning after checking repository policy.
Scope. Static review of 188 tracked files in the public Silo repository at commit 549b0b62bea5fe1e8b38f8203a3fa4b157442371, including Electron startup and preload code, indexing/search, faces and geolocation, Google integration, payment, sharing, build configuration, workflows and the lockfile.
Dependency source. npm audit results were generated from the checked lockfile on 16 October 2026. Vulnerability records describe affected version ranges and dependency paths; they do not by themselves prove that a vulnerable function is reached or exploitable in the application.
Not performed. No release binary was launched; no live network capture, penetration test, account connection, transaction, report submission, phone backup access, or personal-library access was performed. The license relay backend and external provider retention policies were outside the repository and remain unverified.
This page is AI-generated and should be reviewed by the Silo owner before being presented as a definitive security statement. Any corrections should retain the pinned commit and update the audit date when the code or dependency snapshot changes.
Code links below point to the exact reviewed commit, so the evidence remains stable if the repository’s default branch changes.