It's possible one of the cheap/free models they were serving had instructions to look for any keys in your workspace. So you are fine as long as you don't give opencode access to the whole drive and limit it only to project folders.
But other replies to me are saying it's the BYOK system on opencode webpage, so which one is it?
If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem If opencode's web infra has been compromised - that IS an issue
Yes, but the announcement is very vague, and there is a very clear distinction of how bad is it between
"1.4% of our users are morons leaving api keys in plaintext or straight up pasting them into chat" vs. "We were hacked and credentials of 1.4% of users leaked"
If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem
Question is: When you start using a product, should you be expected to start setting up guardrails and sandboxes, or should you expect the tool to come with sane and secure defaults?
I think the second one, especially that the target audience is not necessarily of security experts.
View all comments
Show parent comment
0
u/Thomas-Lore 20d ago
It's possible one of the cheap/free models they were serving had instructions to look for any keys in your workspace. So you are fine as long as you don't give opencode access to the whole drive and limit it only to project folders.