Proof Portal

Sign in
Project overview

Omarchy

ProbeLabs65 findings · 95 requirements

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Inbox
ReportR-1226GitHub issuePublicFixed

Embedded Google OAuth client ID and secret in bin/omarchy-install-chromium-google-account

Reported by satwareAG-ironMike · filed Aug 30, 2026 · open at source

Open at source
Decided: Out of scope — decided by agents · verified 3 days ago.

At a glance

1 · What is claimed?
Only the report text below — no validator has restated it as checkable claims yet.
2 · What does it affect?
AreaOutside the audited area· Decided by agents · verified
3 · Is it reproducible?
No validation has been run yet.
4 · What remains unclear?
  • Not validated yet: no claims, no reproducer.
5 · What happens next?
Decided by agents and verified by a second, independent agent — see the decision.

Original report

Embedded Google OAuth client ID and secret in bin/omarchy-install-chromium-google-accountrevision 1 · captured 2026-09-28 21:24 UTC via poll

bin/omarchy-install-chromium-google-account (lines 11-13) embeds a Google OAuth
client ID and client secret in plaintext:

grep -qxF -- "--oauth2-client-id=77185425430.apps.googleusercontent.com" "$CONF" ||
  echo "--oauth2-client-id=77185425430.apps.googleusercontent.com" >>"$CONF"

grep -qxF -- "--oauth2-client-secret=OTJg****" "$CONF" ||
  echo "--oauth2-client-secret=OTJg****" >>"$CONF"

This is a client-side (Chromium browser) OAuth pair, so the exposure is lower
than a server-side secret - Chromium accepts the client ID for sign-in without
the secret. Two small concerns remain:

  1. The client secret is public in the repo history and tied to your Google

Cloud project. Anyone can associate the client with their own setups, and
if the OAuth consent screen / redirect settings are misconfigured, the
client ID can be used for phishing-style sign-in pages pointing at your
project name.
2. It forces an upgrade dance: rotating the credential requires a new omarchy
release plus re-running the installer.

Suggestion: read the pair from an env var or an omarchy config file at
install time, default to the shipped values if present, and consider rotating
the client in Google Cloud Console if you treat the secret as sensitive.

Found during an independent supply-chain due-diligence scan (not a malicious
report). Happy to help with a PR if useful.

View raw text
`bin/omarchy-install-chromium-google-account` (lines 11-13) embeds a Google OAuth
client ID and client secret in plaintext:

```bash
grep -qxF -- "--oauth2-client-id=77185425430.apps.googleusercontent.com" "$CONF" ||
  echo "--oauth2-client-id=77185425430.apps.googleusercontent.com" >>"$CONF"

grep -qxF -- "--oauth2-client-secret=OTJg****" "$CONF" ||
  echo "--oauth2-client-secret=OTJg****" >>"$CONF"
```

This is a client-side (Chromium browser) OAuth pair, so the exposure is lower
than a server-side secret - Chromium accepts the client ID for sign-in without
the secret. Two small concerns remain:

1. The client secret is public in the repo history and tied to your Google
   Cloud project. Anyone can associate the client with their own setups, and
   if the OAuth consent screen / redirect settings are misconfigured, the
   client ID can be used for phishing-style sign-in pages pointing at your
   project name.
2. It forces an upgrade dance: rotating the credential requires a new omarchy
   release plus re-running the installer.

Suggestion: read the pair from an env var or an omarchy config file at
install time, default to the shipped values if present, and consider rotating
the client in Google Cloud Console if you treat the secret as sensitive.

Found during an independent supply-chain due-diligence scan (not a malicious
report). Happy to help with a PR if useful.

Validation

Not checked yet. A validator will restate this report as checkable claims, map it to the project's requirements and write a reproducer that the proof engine runs.

Linked

  • Fixed bypr/11907· confirmed

Decision

Decisions are recorded by our staff — or, where this project allows it, by agents: checked by a second, independent agent, or by a single agent where the project's policy says so. Any decision reached so far is shown below.

  • Out of scopeDecided by agents · verified · 2026-10-09 10:07 UTC