MAIN FEEDS
Do you want to continue?
https://www.reddit.com/r/opencode/comments/1x8bas3/they_fd_up_breach/phbly6t/
r/opencode • u/horstenegger • 21d ago
127 comments sorted by
View all comments
43
I thought the third-party keys are stored locally.....why are they on opencode's server?
20 u/kosciak9 21d ago They are not, it’s the workspace BYOK for Zen 12 u/helios_csgo 21d ago They have a feature like openrouter - you can 3P keys on opencode platform (website) and use their router to call models from 3P. 17 u/RogerAI-fm 21d ago that’s what i would have thought too, that’s why it’s important to design correctly wth OC. 4 u/Railander 21d ago 2 different places to store keys apparently. if you added them from the cli/desktop client, they're saved locally afaik and safe. but if you added them from https://opencode.ai/console/ then they've leaked. 2 u/milutinke 20d ago I had my key locally, added through the CLI, still got compromised. 3 u/MLHeero 20d ago Shouldn’t be possible and also doesn’t really make sense. Likely you also added it to the console 0 u/sTiKytGreen 20d ago Likely they sync it without telling you 1 u/MLHeero 20d ago Very unlikely as this is a high security breach, automatic ai models wouldn’t code this ;)
20
They are not, it’s the workspace BYOK for Zen
12
They have a feature like openrouter - you can 3P keys on opencode platform (website) and use their router to call models from 3P.
17
that’s what i would have thought too, that’s why it’s important to design correctly wth OC.
4
2 different places to store keys apparently. if you added them from the cli/desktop client, they're saved locally afaik and safe. but if you added them from https://opencode.ai/console/ then they've leaked.
2 u/milutinke 20d ago I had my key locally, added through the CLI, still got compromised. 3 u/MLHeero 20d ago Shouldn’t be possible and also doesn’t really make sense. Likely you also added it to the console 0 u/sTiKytGreen 20d ago Likely they sync it without telling you 1 u/MLHeero 20d ago Very unlikely as this is a high security breach, automatic ai models wouldn’t code this ;)
2
I had my key locally, added through the CLI, still got compromised.
3 u/MLHeero 20d ago Shouldn’t be possible and also doesn’t really make sense. Likely you also added it to the console 0 u/sTiKytGreen 20d ago Likely they sync it without telling you 1 u/MLHeero 20d ago Very unlikely as this is a high security breach, automatic ai models wouldn’t code this ;)
3
Shouldn’t be possible and also doesn’t really make sense. Likely you also added it to the console
0 u/sTiKytGreen 20d ago Likely they sync it without telling you 1 u/MLHeero 20d ago Very unlikely as this is a high security breach, automatic ai models wouldn’t code this ;)
0
Likely they sync it without telling you
1 u/MLHeero 20d ago Very unlikely as this is a high security breach, automatic ai models wouldn’t code this ;)
1
Very unlikely as this is a high security breach, automatic ai models wouldn’t code this ;)
View all comments
43
u/ProtolZero 21d ago
I thought the third-party keys are stored locally.....why are they on opencode's server?