# Security Policy

## Reporting Security Issues

Please report vulnerabilities through a private GitHub security advisory for this repository. Do not attach journals, scene files, logs, or screenshots containing private device state to a public issue.

## Threat Model

Omarchy plugins are unsandboxed and run with the desktop user's permissions. OmaScenes therefore treats both scene configuration and persisted recovery data as untrusted input, while trusting its own installed Bash and QML files.

The project limits that risk as follows:

1. **Strict declarative schemas** — scenes accept exactly seven known desktop setting keys. Journals also have an exact versioned schema, ordered adapter keys, bounded diagnostics, and validated transaction states before recovery dispatch.
2. **Fixed adapter allowlist** — system interaction is limited to `doNotDisturb`, `stayAwake`, `nightLight`, `powerProfile`, `outputVolume`, `outputMuted`, and `microphoneMuted`. Scene data cannot name a command, path, shell fragment, application, or custom adapter.
3. **No dynamic evaluation** — the engine does not source scene data or interpolate it into shell programs. External commands receive discrete arguments.
4. **Private atomic state** — state directories reject symbolic links, use mode `0700`, and journal/result files are atomically replaced at mode `0600` under `umask 077`.
5. **Bounded subprocess I/O** — each adapter command has a combined 65,536-byte output limit before command substitution. The shell reads engine output in chunks, retains at most 131,072 characters across both streams, terminates on overflow, and clears the buffer after each operation.
6. **Serialized, verified transactions** — a non-blocking lock admits one mutation at a time. Every write is queried and compared before the next step; failure triggers reverse rollback.
7. **Ownership-aware restore** — normal restore preserves a value changed after scene activation. Force restore is an explicit secondary action because it can overwrite that drift.
8. **Microphone protection** — muted-to-live transitions require a fresh UI acknowledgement or CLI `--yes`; a previous preview cannot bypass it.
9. **Explicit crash recovery** — an interrupted journal is surfaced for user-directed recovery. Startup and status inspection never mutate settings automatically.
10. **No network, daemon, or telemetry** — operation is local and on demand, with no service installation, remote requests, background polling, or analytics.

OmaScenes cannot protect against modification of its installed executable files or a compromised user session. Review third-party scene files before installing them, keep the repository and Omarchy updated, and use the normal smart restore unless force restore is specifically required.