depletionmode's Semantic search submission, omacom/omarchy-plugin-marketplace#11062, reached publication after HANCORE-linux found two local data exposure paths: a readable plaintext index and a model-server port race that could send private documents to another listener.
depletionmode changed storage to owner-only permissions and replaced TCP model-server connections with private Unix sockets that verify the child process identity before sending data. HANCORE-linux accepted the reviewed fixes, and github-actions[bot] reported publication. Setup remains manual and downloads the model and runtime with pinned hashes; marketplace verification covers the selected snapshot rather than constituting a security audit.
