hizawye's open omacom/omarchy#16343 restricts automatically discovered icons to the final page origin and checks redirects before requesting their destinations. During the discussion, hizawye added bounded page reads, final-page-relative icon resolution and credential retention limited to the same scheme, hostname and effective port. Explicit user-supplied icon URLs retain their existing behavior.
omarchybot reported worker verification of the final reviewed head in omacom/omarchy#16343:issuecomment-6368320917, including 26 focused cases and a real IPv6 server. That followed hizawye's correction of comparisons that had treated IPv6 brackets as patterns. The proposal still awaits a maintainer decision over roughly 250 lines of URL handling and overlap with other icon changes. Its hostname checks are not private-address filtering, and deliberately excluded CDN icons can fall back to Google's favicon.
