Comment by computerex
4 hours ago
Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?
4 hours ago
Why are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?
If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.
The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.
They need to explain this, by releasing a detailed RCA.