Omarchy Stories Debuts with Mehmet Ince from the Omarchy Security Team
Omarchy Stories is live. Episode 001 puts Mehmet Ince — Omarchy Security Team, PRODAFT co-founder — on the mic for 46 minutes of vulnerability research, open-source hardening, and how the volunteer security crew actually works.
Omarchy just got a proper signal for the people building it. Omarchy Stories is on the air, and Episode 001 — Cybersecurity Insights with Mehmet Ince — is available now: 46:27 of real talk on vulnerability research, open-source security, and the Omarchy community.
David Heinemeier Hansson (DHH) — creator of Omarchy, co-owner and CTO of 37signals, and the force behind Ruby on Rails — amplified the launch, pointing listeners to @mdisec on @bastidotnet’s new show (DHH’s post). The project media account @OmarchyStories confirmed episode #001 is live on Apple Podcasts, Spotify, YouTube, and omarchystories.org (announce).
Who’s on the mic
Guest Mehmet Ince (@mdisec, GitHub github.com/mdisec) is on the Omarchy Security Team. In the episode he describes himself as a vulnerability researcher with more than two decades in cybersecurity, and co-founder / CTO of PRODAFT — a European cyber threat intelligence company. He’s also a familiar name in recent Omarchy release notes: security fixes credited to @mdisec shipped in Omarchy 4.0.1 and 4.0.2.
Host Sebastian (@bastidotnet) runs Omarchy Stories. He’s also an Omarchy contributor. The show’s pitch is blunt and on-brand: Omarchy is beautiful, fun, and agentic Linux — opinionated by DHH, but yours to command — and Stories broadcasts the people who bend it, fix it, and pass the knowledge on.
What Episode 001 actually covers
This is not vibe podcasting. Mehmet walks through how he landed on Omarchy Security: he tried the distro, read the open source, found a serious web-to-desktop command-execution path, filmed a proof, posted it, and woke up to a DM from DHH asking him onto the team. That volunteer crew — unpaid, day-job-having, still reading the flood of reports — is the through-line of the episode.
He and Sebastian talk about how the team triages: impact over “looks ugly,” privilege escalation and remote trigger paths first, responsible disclosure over public calculator videos, and the reality that many findings sit in upstream dependencies, so fixing Omarchy often means fixing (or mitigating) the wider Linux stack. Mehmet also frames AI in vuln research honestly: finding bugs got easier; learning from the agent, writing real fixes, and judging impact did not.
If you care about Omarchy after Quattro’s security fast-follows, this is the primary source for how that security culture actually runs.
