Security fixes are made on the latest release and the main branch. Older versions may not receive security updates.

Please do not disclose suspected vulnerabilities in a public issue or pull request. Use GitHub's Report a vulnerability form in the repository's Security tab instead:

https://github.com/EmilsValdmanis/omarchy-localhost/security/advisories/new

Include the affected version or commit, reproduction steps, impact, and any suggested mitigation. You should receive an acknowledgement within seven days. Please allow reasonable time for a fix before public disclosure.

Localhost only controls processes owned by the current user. Before signaling a process, its helper verifies both the /proc owner and Linux process start time captured during discovery. Docker actions require the user's existing Docker daemon access.

When enabled, QR sharing can invoke the fixed /usr/bin/ufw executable through Polkit after an in-plugin confirmation. Rules are limited to the active network interface, current subnet, selected TCP port, and the omarchy-localhost comment. Localhost never runs its own plugin files as root.