48 lines
2.5 KiB
Markdown
48 lines
2.5 KiB
Markdown
# Security at Omarchy
|
||
|
||
## Report a vulnerability
|
||
|
||
If you believe you’ve found a security vulnerability in Omarchy, please tell the [Omarchy Security Team](https://omarchy.org/teams/#security) privately so we have an opportunity to investigate and fix it before it is made public.
|
||
|
||
[security@omarchy.org](mailto:security@omarchy.org?subject=Security%20report)
|
||
|
||
Please don’t report potential vulnerabilities publicly in GitHub Issues, Discord, or social media before they’ve been resolved.
|
||
|
||
## What is a vulnerability?
|
||
|
||
We consider a bug a security vulnerability when it can be exploited to cross a meaningful security boundary: an untrusted or lower-privileged party gains access, permissions, or control they didn’t already have.
|
||
|
||
Code that could be more robust but does not cross a security boundary is an improvement rather than a security vulnerability. We may still merge a proposed fix and credit the reporter in our release notes.
|
||
|
||
Eligibility for our [security credits](https://omarchy.org/security/credits/) page depends on whether a report identifies a confirmed security vulnerability, not on its severity.
|
||
|
||
## What to include
|
||
|
||
Give us enough information to understand and reproduce the issue:
|
||
|
||
- The affected component and Omarchy version.
|
||
- An explanation of what an attacker can do before and after exploitation.
|
||
- Steps to reproduce the issue and any proof of concept.
|
||
- Your preferred contact details for follow-up.
|
||
|
||
## Responsible disclosure
|
||
|
||
Please act in good faith while investigating and reporting vulnerabilities:
|
||
|
||
- Only test systems and accounts you own or have explicit permission to test.
|
||
- Avoid privacy violations, disruption, data destruction, and service degradation.
|
||
- Don’t exploit a vulnerability beyond what is needed to demonstrate it.
|
||
- Give us a reasonable opportunity to investigate and address the issue before publishing details.
|
||
|
||
We’ll review your report and keep you informed as we’re able while we work toward a resolution.
|
||
|
||
## Credits
|
||
|
||
Researchers who privately report a confirmed security vulnerability and give us the chance to ship a fix are thanked on the [security credits](https://omarchy.org/security/credits/) page. Accepted improvements that don’t cross a security boundary may still be credited in our release notes.
|
||
|
||
Credits link to each reporter’s X profile and show their avatar. For duplicate reports, only the first reporter is eligible for credit.
|
||
|
||
## Regular bugs and support
|
||
|
||
For anything that isn’t a security vulnerability, please use the [Omarchy issue tracker](https://github.com/omacom/omarchy/issues).
|