Security
How Omni handles security — what’s supported, how to report a vulnerability, and the architecture that protects your data.
Supported versions
| Version | Supported |
|---|---|
| v1.2.x | ✓ Current — receives fixes |
| v1.1.x | Critical fixes only |
| < v1.1 | ✗ End of life |
Reporting a vulnerability
Please disclose privately — don’t open a public issue. The process:
- Acknowledgement within 72 hours.
- Assessment within 7 days.
- Fix target of 30 days for confirmed issues.
Report via the security contact in the repository’s SECURITY.md / docs/SECURITY.md.
Security architecture
- Encrypted vault — SQLCipher (AES-256) database + AES-256-GCM files, keys in the hardware Keystore.
- Private browsing — isolated GeckoView private contexts.
- Sandboxed extensions — WebExtensions run in a separate process (
extensionsProcess(true)). - No cleartext traffic — the app’s own requests refuse HTTP.
- Log stripping — R8 strips logs in release builds.
Security issues are private
Public disclosure before a fix puts every user at risk. Use the private channel.