Report a vulnerability privately through GitHub Security Advisories. Please don't open a public issue for anything exploitable.

Expect a first reply within a week. Fixes ship in the next patch release, credited unless you'd rather not be.

Silere runs as the user's own session, with their permissions. It has no daemon, no network listener, and no privileged helper. What's in scope:

• Notification content reaching the shell over D-Bus, including icon and image paths.
• Anything the shell passes to a process it spawns.
• Files the shell reads or writes under $XDG_CONFIG_HOME and $XDG_STATE_HOME.
• The installer and updater scripts under scripts/.

Out of scope: Quickshell, the compositor, and anything requiring an attacker who already runs code as the user.

Notification images accept Quickshell's in-memory image provider, but not a filesystem path supplied by the sender. Application icon names still resolve through the installed icon theme.

Updates are verified: scripts/update.sh only fast-forwards to an annotated tag signed by a key in security/update-signers, using the copy of that key already in the installed checkout, and only when the tag belongs to origin/main.

The first install is a different matter. git clone followed by scripts/install.sh runs code from main before any signature has been checked, and a repository that shipped a tampered install.sh would also ship a tampered signer list. Nothing inside the repository can close that gap — verifying a clone needs a trust anchor obtained separately from it. Treat the initial clone as the point where you decide to trust the source, and prefer a distribution package where one is available.