Security
Every reported Omarchy security issue mapped to the fix and the release it shipped in.
cidata drives store the LUKS passphrase in plaintext
Omarchy's unattended install reads a cidata drive whose config carries the LUKS passphrase in plaintext. The risk, and the defer-provisioning path.
Docker group root escalation fixed in Omarchy 4.0.1
The docker group on Omarchy was root-equivalent and granted by default. What the August 2026 root escalation was, and how to check your machine.
Is Omarchy safe to use? The defaults, the criticisms, the fixes
A sourced look at Omarchy security: mandatory LUKS, ufw default deny, the docker group root escalation, and the hardening that shipped in 4.0.1 through 4.0.3.
Notification and video title bash injection in Omarchy 4.0.0
In Omarchy 4.0.0 a web page's video title could reach the command run when you clicked the Download complete toast. Fixed in 4.0.1 by PR 7847 and PR 7926.
Omarchy development practices and AI-written code
The claim that Omarchy's AI-written bash and fast release cadence cause security bugs, with the checkable evidence on both sides, as of v4.0.4.
omarchy plugin add clones upstream HEAD with no pin
omarchy plugin add and omarchy theme install do a bare git clone of a repo's current HEAD. No commit pin, no signature. What that means and how to pin yourself.
Omarchy shell plugins run unsandboxed inside omarchy-shell
Omarchy 4 shell plugins are QML loaded into the long-lived omarchy-shell process with your full user rights. What 4.0.3 scoped, and how to vet a plugin.
Omarchy's passwordless sudo window: risk and how to shorten it
What Omarchy's temporary passwordless sudo window does, the NOPASSWD sudoers file it writes, the real risk, and how to end it early or shorten it.
Stable mirror lag vs Arch upstream, and what it costs you
How far behind Arch the Omarchy stable mirror really runs, measured 2026-09-17, what it cost during the Chromium exploit, and how to switch channels.
Verify an Omarchy ISO: signing key, .sha256 and .sig files
How to verify an Omarchy ISO: the pkgs@omarchy.org signing key fingerprint, the .sha256 and .sig sidecar files, and commands for Linux, macOS and Windows.
What Omarchy encrypts and firewalls by default
Omarchy ships LUKS full-disk encryption and ufw set to deny incoming, with port 53317 open for LocalSend and ufw-docker rules. What that covers and misses.