On August 25, a security researcher published a post titled "Merchants of Insecurity," opening with "Do NOT use Omarchy if you care about security of your machine even a little bit." Two weeks later, Omarchy's backers pledged three million dollars. Neither fact cancels the other out. Both are true, and both matter if someone on your team just asked whether they can wipe their work laptop and install it.
What Just Happened, in Order
Omarchy is David Heinemeier Hansson's opinionated Arch Linux and Hyprland desktop — the same DHH who built Ruby on Rails and runs 37signals. It's grown from a personal dotfiles project in June 2025 into one of the more talked-about developer desktops around, and my colleague covered the 4.0 "Quattro" rewrite when it shipped on August 14, 2026. What's happened since is the part worth a second look:
- August 2026: The Omacom Foundation is established as a nonprofit to govern Omarchy's development — a real step away from "one person's project," with its own funding and staff separate from 37signals.
- August 25, 2026: A security researcher publishing as One Happy Fellow publishes "Merchants of Insecurity," documenting a batch of real vulnerabilities in the freshly shipped 4.0 — command injection via a crafted video title, notifications that could run arbitrary bash, and more — and arguing the bugs trace back to AI-generated bash scripts handling untrusted input "with seemingly no review."
- Soon after: Omarchy ships v4.0.1, fixing the reported video-title and notification bugs in the same release as a Lua injection via USB device names, a predictable temp-file path in FIDO2 setup, and making the Docker group opt-in instead of automatic on new installs — a wider batch than the original report alone.
- September 7: Omarchy.org relaunches in 29 languages.
- September 9: DigitalOcean joins as a Founding Corporate Patron — $1 million a year for three years, $3 million total — and Quickshell's creator, "outfoxxed," is hired full-time as Head of Omarchy Shell.
- September 10: Emir Beganović is hired as Head of Infrastructure, the Foundation's third full-time hire, joining November 1.
- September 11: Omarchy M ships, aimed at users migrating off Apple hardware.
By early September the Foundation had raised over $12.6 million, on top of 200,000+ downloads of the Quattro ISO and a 35,000-member Discord. That's a serious institutional bet on a project that, roughly two weeks earlier, had a security researcher telling readers not to run it at all.
The Criticism Isn't New, and It Isn't Fringe
Credit where it's due: the reported bugs got fixed, in one release, along with several more the same review turned up. That's a real, fast response. But the researcher's framing was pointed, not a footnote — the post accuses the project's leadership of "marketing deception" over its security claims, and the root cause it names is a genuinely uncomfortable one for a desktop that markets itself on agentic AI: bash scripts handling untrusted input, apparently AI-generated, that nobody reviewed closely enough to catch a video title turning into a shell command.
Separately, a longer-running thread on Framework's community forum, arguing Omarchy shouldn't be listed as a supported install option on their laptops, raises criticisms that have nothing to do with any single patched bug:
- The firewall wasn't actually enabled by default until version 3.1.0, despite the configuration implying it was.
- SSH is open through the firewall by default, with defaults a security review would flag on Windows or macOS.
- The project relies on
sudorather thandoas, with password retry limits looser than typical hardening guides recommend. - Installation still leans on scripts that pipe
curloutput directly into a shell, rather than signed packages. - The desktop doesn't lean on kernel-level hardening (Linux Security Modules, hardened memory allocators) the way security-first distros do.
The most common defense, and it's a fair one: Omarchy explicitly markets itself as an opinionated distro for developers, not a hardened enterprise OS, and judging it against a CIS benchmark is judging it for a job it never claimed to do.
Both things are true at once. That's the actual situation, not a contradiction to resolve.
The Pattern to Notice
A researcher found real, working bugs — and used the harshest language a security writeup gets — about two weeks before institutional funders wrote real checks. Funding and legitimacy are correlated, but they're not the same thing, and the second one is what your risk assessment should actually be checking.
How I'd Actually Evaluate the Request
When someone on a team I'm advising wants to run something like Omarchy, I'm not trying to talk them out of it — tiling window managers and a keyboard-first workflow are a genuine productivity gain for the right person, and I've written about that learning curve honestly elsewhere. The questions that actually matter are boring on purpose:
- What does this machine have access to? A personal laptop with no VPN, no production credentials, and no customer data is a different risk than the machine that's SSH'd into your infrastructure.
- Who owns patching when the next CVE lands? "The community will probably fix it fast" is true and also not a patch management policy.
- Does anything here bypass your existing security tooling? MDM, disk encryption enforcement, and endpoint monitoring built for Windows or macOS often simply don't exist for an Arch-based desktop — that gap doesn't show up until you need it.
- What's the recovery plan the week before a deadline? A from-scratch shell rewrite three weeks old is not the machine you want failing during a client delivery.
- Is there an AI coding agent involved, and what can it touch? Omarchy ships nine pre-wired coding agent launchers. Every one of them is a tool that can read files and run commands on whatever this machine has access to — which loops straight back to question 1.
None of these are "no." They're the actual homework, and most businesses skip it because the request arrives framed as a productivity upgrade, not a security decision.
The Bottom Line
Institutional money and a documented CVE aren't in tension — they're both signs of a real, fast-growing project going through exactly the growing pains you'd expect. The mistake isn't letting someone run Omarchy. It's not having anyone whose job it is to ask the five questions above before the laptop gets wiped. That's the gap a technology review exists to close — a straight answer on what a new tool actually touches before it becomes a habit nobody remembers approving.
Book a Free Technology Review Call →
Frequently Asked Questions
Is Omarchy safe to use for work?
It depends what "work" means. Omarchy is a real, actively maintained open-source project with a dedicated security team and now institutional funding behind it. It's also an Arch-based rolling-release distro maintained by a small team, with a documented history of real vulnerabilities and design choices — sudo over doas, SSH open by default, curl-piped install scripts — that a security-conscious IT policy would flag on any distro. Whether that's acceptable depends on what the machine touches, not on Omarchy's reputation alone.
What security vulnerabilities were found in Omarchy 4.0?
A security researcher publishing as "One Happy Fellow" documented a batch of issues in a post titled "Merchants of Insecurity" on August 25, 2026, including command injection via a crafted video title, notifications that could run arbitrary bash, a Lua injection via USB device names, and a predictable temp-file path in FIDO2 setup. Omarchy's v4.0.1 release fixed all of these in one pass, alongside removing a sudo lockout reset command and making the Docker group opt-in instead of automatic on new installs.
What is the Omacom Foundation, and is Omarchy still just DHH's personal project?
The Omacom Foundation is a nonprofit established in August 2026 to govern Omarchy's development, moving it beyond a personal project of 37signals CEO David Heinemeier Hansson (DHH). By September 2026 it had raised over $12.6 million, including three-year commitments from 1Password and 37signals and a $3 million, three-year Founding Corporate Patron commitment from DigitalOcean, and had hired its first full-time staff, including Quickshell's creator as Head of Omarchy Shell.
Should a business let employees install Omarchy on a company laptop?
Treat it the same way you'd treat any unmanaged operating system request: what data does this machine touch, who patches it when a CVE lands, and what's the recovery plan if it breaks the week before a deadline. A personal side machine with no access to customer data is a different conversation than a primary work laptop with production credentials on it.
Is Omarchy free, and what license is it under?
Yes. Omarchy is open source under the MIT license, built on Arch Linux with the Hyprland compositor. It costs nothing to install; the cost, if there is one, shows up later in support and patching responsibility.
About Code to Cloud
We're based in Alberta and help growing businesses across Western Canada make calls like this one — not "is the new tool cool," but "what does it actually touch, and who's responsible when it breaks." Disclaimer: This article provides general information only and does not constitute legal, financial, or professional advice. Every business situation is different. Consult with qualified professionals for advice specific to your circumstances. Code to Cloud is not liable for any actions taken based on this content.
