C411 Trend runs unsandboxed inside omarchy-shell, like every Omarchy plugin. It reads your C411 statistics with a personal API key you create on c411.org with the read-only "Profile (read)" scope (profile:read). This page says exactly what it touches, where the key goes, and which limits keep a misbehaving server or a corrupt file from hurting the shell.

Since 2.0 the plugin reads no browser data: no cookie stores, no keyring, no decryption. 1.x did; that code is gone.

• No privilege escalation: nothing runs as root, no sudo/pkexec, no policy files, no services, no install scripts. It is QML, JavaScript and one Python script (bin/c411trend-fetch) running as your user.
• No network access except one HTTPS request to https://c411.org/api/user/profile per poll (every 30 minutes by default; C411 allows 30 requests a minute per key). No redirects are followed, no other host is contacted, no telemetry.
• The key is never written to shell.json, never put on a command line (ps cannot see it), never logged or printed, and never sent anywhere but c411.org.
• No writes outside its own files: ~/.config/c411trend/api-key (the key), ~/.local/state/c411trend/ (history and its lock), and its entry in ~/.config/omarchy/shell.json through the shell's settings API.

~/.local/state/c411trend/history.jsonl (directory 0700, file 0600): one line per poll with a timestamp, uploaded/downloaded byte counts, ratio, upload and download credit, XP, level and Zen. No key, no username, no torrent data. Deleting the directory resets the plugin.

The latest full profile (username, team, class, alerts) is kept in memory only. The widget's entry in shell.json holds your settings and the last what-if question (simQuery, at most 64 characters).

All text the widget shows, the bar label included, uses Text.PlainText: a username, team name or block reason cannot inject markup. Messages come from fixed English and French catalogues, filled with values, never built from them.

curl -q -sS --compressed --proto =https --max-redirs 0 \
     --max-filesize 1048576 -m 15 -A "C411Trend (+omarchy plugin)" \
     -H "Accept: application/json" -w "\n%{http_code}" \
     -K - https://c411.org/api/user/profile

• -q comes first so ~/.curlrc is ignored: a trace or verbose line there would otherwise print the key.
• The Authorization header arrives on stdin as a curl config line (-K -).
• Only the last line of curl's stderr is ever shown, stripped of control characters and cut to 200 characters.

• npm test: model tests (node) and script tests (Python) run against a stub of the documented endpoint. They cover the key on stdin and never in argv, ~/.curlrc isolation, key validation and storage (permissions, symlinks, injection attempts), every HTTP status the API documents, oversize and slow answers, invalid numbers and booleans, string sanitising, history permissions and compaction, bar-template and what-if bounds, and that both message catalogues carry the same placeholders.
• npm run check: the above, then the Omarchy plugin marketplace's Automated Security Baseline on the committed tree, which must report passed with no findings and no capabilities, then omarchy plugin validate. CI runs the baseline against a pinned marketplace commit.

docs/demo/ is for maintainers and is never run by the plugin. To take screenshots without real data, photo-session.sh temporarily swaps your history and bin/c411trend-fetch for a made-up history and a stub that never contacts c411.org. It restores both, and shell.json, byte for byte on exit, error or Ctrl-C, and checks the result. Only a SIGKILL can stop that; the script prints where the originals are kept before it changes anything. It never touches your API key.

Open an issue, or for anything sensitive contact the author through GitHub (XNinety9) before publishing details.