Guides

An extension trusts a client-submitted total instead of recalculating server-side. A buyer may be charged less than the actual order value.

A cache stores personalized or restricted output as a public response. One visitor may receive another user's content.

A booking link or token appears in a public response. Someone else may view or manage a reservation.

A booking plugin accepts a delete action from an unverified caller. Reservations may disappear or be canceled maliciously.

A restoration action accepts a caller without administrative rights. Site files and database contents may be replaced.

An importer unpacks an archive whose entries target paths outside its destination. Files elsewhere on the server may be overwritten.

A download handler accepts a path or ID outside the caller's allowed files. Private uploads or configuration files may be disclosed.

A cleanup or media handler deletes a path supplied by an unauthorized user. Site files or backups may be removed.

A WordPress application password appears in logs, backups, or a public repository. An external client may gain API access with that credential.

Many login attempts reuse passwords stolen from other services. A reused administrator password may give an attacker dashboard access.

Login or reset screens reveal whether an email address has an account. Attackers can build a target list for password attacks.

Back up your personal files first; an ISO installation can erase the selected drive.

Use Omarchy’s GitHub issue tracker for a reproducible product bug.

Record the Omarchy version, steps to reproduce, hardware details, and a debug log.

Check your custom Hyprland bindings and whether the configuration loaded.

A black screen has several possible causes, including display configuration or a failed desktop component.

Back up your personal files and customized dotfiles separately from Omarchy’s system snapshots.

Use Update > Config in the Omarchy menu for the affected file.

Try booting the snapshot from before the update.

Run omarchy version in a terminal.