O.M.A. is an early desktop assistant with full local command access. Its confirmation rules are agent instructions, not a sandbox. Use it only with accounts and data you are comfortable making available to the configured models.

Report sensitive vulnerabilities through GitHub's private vulnerability reporting for this repository. Do not post credentials, personal data, exploit details that expose users, or unredacted conversation logs in public issues.

Include the affected commit, Omarchy, OpenAI SDK and model versions, minimal reproduction, expected behavior, and impact. Use fictional inputs and redact screenshots.

No formal security audit has been performed. The automated checks are limited validation, not a security certification. Only the latest main branch is maintained.