Omarchy opens a $100,000 HackerOne bounty, with Mehmet İnce as head of security
DHH says the Omacom Foundation has put $100,000 behind a HackerOne program, and that Mehmet İnce is joining Omarchy Core to run it.
Omarchy now has a paid way to report a vulnerability in private. In a news post dated October 2, 2026, DHH says the Omacom Foundation has funded an official bug bounty on HackerOne with $100,000 for payouts, so a researcher who finds a real issue and reports it privately can get paid.
The post says HackerOne is meant to be the familiar inbox: researchers submit a finding, follow the fix, and collect the bounty, while the Omarchy Security Team gets a triage workflow for the reports that come in. Anyone who does not want a HackerOne account can still email security@omarchy.org. The security page spells out what counts as a vulnerability and how to file one, and it points researchers at the program itself.
On that page, Omarchy treats a bug as a security vulnerability only when it crosses a meaningful boundary: an untrusted or lower-privileged party gains access, permissions, or control they did not already have. Code that could be more robust but does not cross that line is an improvement, not a bounty case. Reports should include the affected component and Omarchy version, what an attacker can do before and after, steps to reproduce, and a contact for follow-up. Public filing on GitHub Issues, Discord, or social media before a fix is explicitly discouraged.
The same announcement names the person who will run it. DHH says Mehmet İnce is joining Omarchy Core as head of security. He was already a key member of the Omarchy Security Team; the post says he will set direction for how Omarchy stays safe, from the bounty program to building security into what ships. DHH credits patrons for putting real money behind that work.
The program page is hackerone.com/omarchy, as listed on Omarchy’s security page. Reward amounts, scope, and what HackerOne shows as in or out of scope live there, not in the news post, so a researcher should read that policy before assuming a finding qualifies.
