Security

Found a problem? Tell us.

We would rather hear about it from you than read about it somewhere else.

Our own rule

Nothing we ship runs privileged code from the network in the background. Installs and updates happen in front of you, and ask for your password.

How to report

Write to us directly.

One address, read by the people who build the software. No template, no report number.

[email protected]
01

What to include

What you found, how to reproduce it, and what you think the impact is. A rough description is enough to start.

02

Give us time

Please do not publish the details until we have had a fair chance to fix them.

03

What happens next

We acknowledge the report, keep you updated, fix real problems as quickly as we responsibly can, and credit you if you wish.

IN SCOPE

What to report here

  • Our apps and installers
  • This website and its documentation
  • Anything that could make our software run code you did not ask for
GOOD FAITH

No legal action

We will not pursue anyone who reports in good faith and does not harm other people's data or systems.

MACHINE-READABLE

security.txt

The same contact details in the standard format: /.well-known/security.txt.

Draft policy. Set the response times you can actually keep, and create [email protected], before launch.
Published

Reviews we publish.

Omarchy Store, 11 October 2026: the website, the install scripts, the desktop app, the backend worker and the build pipelines. The review sets out the three problems it found and fixed and the open items that need a decision; it also says what it did not check. The document ships with the source.

This page is machine translated. The English version prevails if the two differ.