Security
How SakuraOS keeps your computer up to date and your software genuine, what it does not do, and how to report a security problem.
Reporting a security problem
If you have found a security problem in SakuraOS itself, such as in the installer, the App Store, the Update Center or SakuraOS's packages, please report it privately rather than in a public issue:
Go to the Security page of the SakuraOS repository.
Choose Report a vulnerability. You need a GitHub account.
Describe the problem and how to reproduce it.
Only the project's maintainers can see the report, and they reply to you there.
Problems in software that SakuraOS takes from Arch Linux, such as Firefox or KDE Plasma, belong with that software's developers. Once they release a fix and Arch Linux packages it, it reaches you with the next nightly update.
Updates
Most security fixes arrive as ordinary updates, so the most important thing SakuraOS does for your security is install them. It does this every night by itself; see Updates. An update is only held back if it broke SakuraOS's test machine, until it is fixed, or if Arch says it needs a manual step, for two weeks at most. The Update Center tells you when that happens. If your computer cannot check for those warnings, it installs updates anyway rather than falling behind.
Some updates, such as a new kernel, only take effect after a restart. The Update Center tells you when one is waiting.
Genuine software
Every package SakuraOS installs, from SakuraOS or from Arch Linux, is signed, and pacman refuses a package whose signature does not match. This is what protects you from a tampered download, whichever server it came from.
The installer image is signed too. See Getting SakuraOS for how to check it before you install.
Applications from Flathub and the Snap Store are checked by their own systems. The AUR is different: nobody reviews its build scripts, which is why it is off by default and why the App Store shows you each build script before running it. See The AUR.
What is protected, and what is not
| Protection | On SakuraOS |
|---|---|
| Disk encryption | Optional, chosen during the install. Without it, anyone with your computer can read your files by starting it from a USB stick. SakuraOS cannot add it later; that means reinstalling. |
| Secure Boot | Optional. See Secure Boot. |
| Firewall | None is installed. A fresh install runs no service that accepts logins or files from the network. It answers other computers on your local network that look it up by name, and while you are logged in, KDE Connect listens for phones and computers to pair with; it only exchanges anything with a device you have approved on this computer. If you install software that does accept connections, such as a file-sharing or remote-access service, set up a firewall with it. |
| Remote login (SSH) | Off. To log in to this computer from another one, turn it on with sudo systemctl enable --now sshd, and prefer SSH keys to passwords. |
| Applications in a sandbox | Flatpaks and most Snaps run in one, with the permissions shown on their App Store page. SakuraOS and AUR packages do not; they can do anything you can. |
| Known-compromised AUR packages | Checked daily against published lists of AUR packages that have been compromised. This only catches what has already been reported. It is not a virus scanner. |
| Antivirus | None. Linux desktop malware is rare, and it almost always arrives in software you chose to install. Install from the SakuraOS repositories, Flathub or the Snap Store, and treat downloads from websites with the same care as on any computer. |
Terminal Assist is not a security feature
Terminal Assist stops common commands that would break the system by accident. Anyone with your password can switch it off or step around it. It protects you from mistakes, not from an attacker.
Last checked against the SakuraOS release of 3 October 2026. If your system behaves differently from this page, the page is wrong: please report it.