Security at Omarchy

What is a vulnerability?

We consider a bug a security vulnerability when it can be exploited to cross a meaningful security boundary: an untrusted or lower-privileged party gains access, permissions, or control they didn’t already have.

Code that could be more robust but does not cross a security boundary is an improvement rather than a security vulnerability. We may still merge a proposed fix and credit the reporter in our release notes.

Eligibility for our security credits page depends on whether a report identifies a confirmed security vulnerability, not on its severity.

What to include

Give us enough information to understand and reproduce the issue:

• The affected component and Omarchy version.
• An explanation of what an attacker can do before and after exploitation.
• Steps to reproduce the issue and any proof of concept.
• Your preferred contact details for follow-up.

Responsible disclosure

Please act in good faith while investigating and reporting vulnerabilities:

• Only test systems and accounts you own or have explicit permission to test.
• Avoid privacy violations, disruption, data destruction, and service degradation.
• Don’t exploit a vulnerability beyond what is needed to demonstrate it.
• Give us a reasonable opportunity to investigate and address the issue before publishing details.

We’ll review your report and keep you informed as we’re able while we work toward a resolution.

Credits

Researchers who privately report a confirmed security vulnerability and give us the chance to ship a fix are thanked on the security credits page. Accepted improvements that don’t cross a security boundary may still be credited in our release notes.

Credits link to each reporter’s X profile and show their avatar. For duplicate reports, only the first reporter is eligible for credit.

Regular bugs and support

For anything that isn’t a security vulnerability, please use the Omarchy issue tracker.