Posted by pranshuchittora 5 hours ago
you login to their website, and you are presented with a list of providers where you can click and add your provider api key.
how the key is stored on the backend isn't clear, but it is akin to handing your password or if you know crypto, your private key, to someone and letting them store it for you.
from what i can tell, there are no links within the console to a ToS, Privacy policy or anything else. there are no warnings or documentation about how they store your keys.
someone else in this thread linked to this issue, but this comment is especially insane given that i can't find any privacy policy or tos for the console.
https://github.com/anomalyco/opencode/issues/10416#issuecomm...
I looked at the linked comments, and they seem valid. I mean I dont want to go full tinfoil hat here, but what's the deal? Some people just really like opencode or something?
https://news.ycombinator.com/item?id=50075319
https://news.ycombinator.com/item?id=50060694
what’s interesting is that all those efforts that go into sandboxing through virtualization wouldn’t have helped here. But the solutions that proxy the api keys and hide them from agents might have worked as a defense in depth.
of course any sensible engineer that uninstalled this 6 months ago and used codex and claude code directly also avoided this, gg
Exterior-compliance proxies, yes, are a good thing; but are also completely unrelated to the fact that OpenCode's hosted solution, that requires having credentials in some fashion, was popped.
Shitting on anyone who uses OpenCode (rather than your preferred vendor-specific product) as not being "sensible" is also completely out of hand and unnecessary.
---
Hi, We identified unauthorized access to a legacy system that we were in the process of decommissioning. Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed. Please revoke and replace those keys through the relevant provider’s dashboard, update any applications using them, and review recent usage for unexpected activity.
We’re sorry this happened and will follow up with any updates.
This was a leak of keys added in a web UI
Me, 68 days ago:
> Beware of the author of tweet, who happens to be author of OpenCode - OpenCode will leak all your data to themselves and to shady 3rd parties. Author feigned ignorance and never fixed the issue. OpenCode among other harnesses is the shadiest of all.
I did have an account but moved off for security reasons.
That is it. It is still private by default
All it "ever did" was send your entire prompt/context to a "free" model for harvesting. The astroturfing in this thread is absurd.
Maybe try a sensible approach first, cause so far this is assumed, for no reason, to be done maliciously. "to steal data" and the like.
Opencode's source code is public, so you can verify any claim against it directly.
During this short period - yes. Unless it finds a valid small model, or you set one yourself - it would use the one provided by zen. or you could disable it with an invalid model altogether. Good gesture for most users and something else to others.
It's *could by the way, as this was only a short window when this was a thing. It went back to not having this fallback pretty fast, i don't think it even lasted a month.