Security at Omarchy
How to responsibly report a security vulnerability in Omarchy.
Report a vulnerability
If you believe you have found a security vulnerability in Omarchy, tell the Omarchy Security Team privately so it has an opportunity to investigate and fix it before it is made public.
Do not report potential vulnerabilities publicly in GitHub Issues, Discord, or social media before they are resolved.
What is a vulnerability?
A bug is a security vulnerability when it can be exploited to cross a meaningful security boundary: an untrusted or lower-privileged party gains access, permissions, or control it did not already have.
Code that could be more robust but does not cross a security boundary is an improvement, not a security vulnerability. A proposed fix may still be merged and credited in release notes.
Eligibility for security credits depends on a report identifying a confirmed security vulnerability, not its severity.
What to include
Give the team enough information to understand and reproduce the issue:
- The affected component and Omarchy version.
- An explanation of what an attacker can do before and after exploitation.
- Steps to reproduce the issue and any proof of concept.
- Your preferred contact details for follow-up.
Responsible disclosure
Act in good faith while investigating and reporting vulnerabilities:
- Only test systems and accounts you own or have explicit permission to test.
- Avoid privacy violations, disruption, data destruction, and service degradation.
- Do not exploit a vulnerability beyond what is needed to demonstrate it.
- Give the team a reasonable opportunity to investigate and address the issue before publishing details.
The team will review your report and keep you informed as it is able while it works toward a resolution.
Credits
Researchers who privately report a confirmed security vulnerability and give the team the chance to ship a fix are thanked on the security credits page. Accepted improvements that do not cross a security boundary may still be credited in release notes.
For duplicate reports, only the first reporter is eligible for credit.
Regular bugs and support
For anything that is not a security vulnerability, use the Omarchy issue tracker.