Security fixes are provided for the latest tagged beta or stable release.

Do not open a public issue for a vulnerability that could expose user data, credentials, or repository secrets. Use GitHub private vulnerability reporting:

https://github.com/duclucky/omarchy-plugin-ci/security/advisories/new

Include the affected version, a minimal reproduction, impact, and any proposed mitigation. Please avoid accessing data that is not yours while validating a report.

The Action uses the caller's checked-out plugin as untrusted input. It parses files and copies them into a temporary directory. The lifecycle simulation does not execute plugin code. Optional qmllint reads QML files but does not start an Omarchy or Quickshell session.

Recursive static scans ignore symbolic links. Manifest entry-point symlinks are resolved and accepted only when their final target remains inside the plugin directory. This prevents a pull request from using a symlink to make the report read an unrelated runner file.

Use the default contents: read workflow permission. The Action does not need a GitHub token, network access, write permission, sudo, or repository secrets.

The capability scanner is a bounded pattern review. A clean report is not a security certification and does not prove that a plugin is safe.