It's not like there wouldn't be any other harnesses either. Just switch to literally anything else please.

> related to a large scale distillation attack

I'm not sure how this adds up. I could understand if this impacted their uptime, but not security.

Are they actually saying a bunch of credentials were stolen and are being used for distillation?

you login to their website, and you are presented with a list of providers where you can click and add your provider api key.

how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.

from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.

someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.

https://github.com/anomalyco/opencode/issues/10416#issuecomm...