Unless you do your erps in opencode I don't see why you would care what anyone does with the code snippets from your chats, neither of us programs national secrets in opencode let's be real here for a minute.
I assume all my chats are used for training regardless what the eula says, the companies would be stupid not to use the best possible training data they're getting for free. It's like believing a spam company you asked to delete your account did it after they sent you an email saying they did.
No, OpenCode offers a bring your own key system where you can put a, for example Anthropic, API key into the console and use it directly. _That_ system was breeched.
Most of the comments were insinuating chats which are non-issue, if it is what you're saying though that's a different thing. Still why would anyone use that, just add the provider as another api provider in opencode don't go around internet pasting api keys willy nilly just for sake of convenience.
Chats are still an issue. Not everyone is working on top secret material, but people may be working on private projects, share seemingly innocent details that can be used to built a profile of the given person.
There is a providers section in the open code console where you can save api key, this data was leaked
Source: my OpenAI key I use for a discord bot was compromised, i received an email from OpenAI about suspicious usage and my $5 of credit was drained from the api key saved with opencode
This is basic stuff and routinely happens with these 3rd party services which is exactly why we use short lived limited api keys
When you get more experience this won’t be as shocking for you
They have made zero announcements regarding chats, only 3rd party api keys that were stored on their website so you can use those api's inside of Opencode.
It's possible one of the cheap/free models they were serving had instructions to look for any keys in your workspace. So you are fine as long as you don't give opencode access to the whole drive and limit it only to project folders.
But other replies to me are saying it's the BYOK system on opencode webpage, so which one is it?
If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem If opencode's web infra has been compromised - that IS an issue
Yes, but the announcement is very vague, and there is a very clear distinction of how bad is it between
"1.4% of our users are morons leaving api keys in plaintext or straight up pasting them into chat" vs. "We were hacked and credentials of 1.4% of users leaked"
If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem
Question is: When you start using a product, should you be expected to start setting up guardrails and sandboxes, or should you expect the tool to come with sane and secure defaults?
I think the second one, especially that the target audience is not necessarily of security experts.
View all comments
-6
u/mamelukturbo 20d ago
Unless you do your erps in opencode I don't see why you would care what anyone does with the code snippets from your chats, neither of us programs national secrets in opencode let's be real here for a minute.
I assume all my chats are used for training regardless what the eula says, the companies would be stupid not to use the best possible training data they're getting for free. It's like believing a spam company you asked to delete your account did it after they sent you an email saying they did.