# How Security Filters Are Applied to Omarchy Themes > Learn how Omarchy applies security filters to themes from Git repos. Discover how executable files, symlinks, and terminal configs are blocked during staging. - Repository: [Omacom/omarchy](https://github.com/omacom/omarchy) - Tags: how-to-guide - Published: 2026-09-04 --- **Omarchy applies strict security filters to themes installed from remote Git repositories by blocking executable Lua files, symlinks, and sensitive terminal configuration files during the staging process executed by the `omarchy-theme-set` script.** Omarchy maintains a clear distinction between *trusted* themes—those distributed with the repository or created manually in `~/.config/omarchy/themes/`—and *installed* themes sourced from external Git repositories via the `omarchy theme install` command. To prevent arbitrary code execution and filesystem traversal attacks, the system sanitizes all incoming theme files through a multi-layer filtering mechanism implemented in `bin/omarchy-theme-set` before activation. ## Trusted vs. Installed Themes: Understanding the Security Model The security architecture treats local themes differently from remote downloads. Trusted themes reside in the local filesystem and bypass all filters, allowing complete customization including Lua scripts and terminal configurations. Installed themes, however, are cloned from remote Git repositories into a temporary staging directory where the `is_denied_installed_file` function evaluates every file against security rules before copying to the active theme location. This design ensures that while users can manually create fully functional themes with executable components, themes downloaded from the internet cannot inject malicious code through interpreted languages or manipulate sensitive application configurations. ## The Four-Layer Filtering Mechanism The filtering logic in `bin/omarchy-theme-set` (source: [omacom/omarchy](https://github.com/omacom/omarchy/blob/quattro/bin/omarchy-theme-set)) operates through four distinct security checks that examine each file during the staging phase. ### Blocked Configuration Files (The Deny-List) At lines 30-31, the script defines the `INSTALLED_THEME_DENIED` array containing specific terminal emulator and editor configuration files that could alter system behavior if modified: ```bash INSTALLED_THEME_DENIED=(alacritty.toml foot.ini ghostty.conf kitty.conf vscode.json) ``` Any file matching these names is automatically dropped during staging, preventing malicious themes from injecting arbitrary configuration into Alacritty, Foot, Ghostty, Kitty, or VS Code. ### Lua Script Blocking Files with the `.lua` extension are unconditionally stripped from installed themes. Since Omarchy uses Lua for configuration scripting across Hyprland, Neovim, and other components, this restriction prevents malicious themes from executing arbitrary Lua code on the user's system. The filter treats all Lua files as potential executable payloads regardless of their stated purpose. ### Symlink Traversal Protection The script checks each entry with `[[ -L $entry ]]` to detect symbolic links. If a file is a symlink, it is excluded from the staged theme to prevent directory traversal attacks where a malicious repository might link to sensitive files like `/etc/passwd` or private SSH keys outside the theme directory. ### Staging Validation Logic The core filtering function `is_denied_installed_file` (lines 138-145) orchestrates these checks. This function returns a non-zero exit status for any file that matches the deny-list, carries a `.lua` extension, or exists as a symbolic link, causing the staging process to skip that entry and print a warning to *stderr*. ## Installation Flow with Security Filtering When you install a theme from a remote URL, the filtering occurs transparently during the staging phase: ```bash # Install triggers the clone and staging process omarchy theme install https://github.com/username/awesome-theme.git # Set activates the filtered version omarchy theme set awesome-theme ``` During execution, the script copies files from the cloned repository to a temporary staging area, invoking `is_denied_installed_file` for each entry. Only files that pass all security checks proceed to the final activation step. ## Example Warning Output If a remote repository contains prohibited files, the staging process outputs specific warnings while continuing with safe files: ```text $ omarchy theme set awesome-theme # … staging … # Dropped disallowed file: myapp.lua # Dropped disallowed file: vscode.json ``` After installation, the active theme directory contains only sanitized static resources, color palettes, and non-executable configuration templates generated from `default/themed/*.tpl` files. ## Summary - **Omarchy distinguishes** between trusted local themes and untrusted remote themes installed via Git. - **The `INSTALLED_THEME_DENIED` array** in `bin/omarchy-theme-set` (lines 30-31) blocks specific terminal configuration files including [`alacritty.toml`](https://github.com/omacom/omarchy/blob/main/alacritty.toml), [`kitty.conf`](https://github.com/omacom/omarchy/blob/main/kitty.conf), and [`vscode.json`](https://github.com/omacom/omarchy/blob/main/vscode.json). - **Lua files are automatically stripped** to prevent code injection into Hyprland and Neovim. - **Symbolic links are excluded** during staging to prevent filesystem traversal attacks. - **The `is_denied_installed_file` function** (lines 138-145) enforces these rules during the temporary staging phase before activation. ## Frequently Asked Questions ### Why does Omarchy apply security filters only to installed themes? Omarchy trusts themes created manually in `~/.config/omarchy/themes/` or shipped with the repository because they require local filesystem access to create, implying explicit user consent. Remote themes installed via `omarchy theme install` execute code from the internet, necessitating strict filtering to prevent supply-chain attacks where a compromised repository could execute malicious Lua or modify terminal configurations. ### What specific files are blocked by the deny-list? The `INSTALLED_THEME_DENIED` array explicitly blocks [`alacritty.toml`](https://github.com/omacom/omarchy/blob/main/alacritty.toml), [`foot.ini`](https://github.com/omacom/omarchy/blob/main/foot.ini), [`ghostty.conf`](https://github.com/omacom/omarchy/blob/main/ghostty.conf), [`kitty.conf`](https://github.com/omacom/omarchy/blob/main/kitty.conf), and [`vscode.json`](https://github.com/omacom/omarchy/blob/main/vscode.json). These files control terminal emulator and editor settings that could alter application behavior or leak information. Additionally, all files with `.lua` extensions and any symbolic links are removed regardless of name. ### Can I override the security filters for a specific remote theme? No, the filtering mechanism in `bin/omarchy-theme-set` is mandatory for all themes installed from Git repositories. The `is_denied_installed_file` function executes unconditionally during staging with no override flag. To use a theme containing Lua scripts or blocked configuration files, you must manually copy the repository contents to `~/.config/omarchy/themes/` as a trusted theme, accepting full responsibility for the security implications. ### How can I verify that a theme was properly filtered during installation? Run `omarchy theme set ` and observe the standard error output. The script prints `Dropped disallowed file: ` for each filtered entry. After activation, inspect the staged theme directory to confirm that `.lua` files, symlinks, and deny-listed configurations are absent, leaving only static resources and color palette definitions.