Comment by jchw
5 hours ago
I don't use OpenCode but I would like to know who this impacts. Surely people who are just using OpenCode locally with their own credentials wouldn't be impacted, right? This sounds like something where you have a hosted service and you put your keys into that. Not saying this isn't bad, but it isn't clear and they're not sharing any information.
This appears to affect users of Opencode Console, which appears to be an Openrouter-type thing?
https://dev.opencode.ai/console/
It's actually kinda hard to figure out what it is. But it does appear to be different that the CLI
From https://opencode.ai/v2/docs#connect :
> If you’d like easy access to all the best coding models you can try out OpenCode Console.
Turns out even if you used credentials locally, you could've have been impacted as the .env files were also consumed by the agents. This is from some comments on Reddit / Google, so take it with a grain of salt.