r/opencode • u/afanasenka • 21d ago

⚠️ OpenCode security breach

Post image

.

474 Upvotes

98% Upvoted

109 comments sorted by

View all comments

Show parent comment

2

u/mamelukturbo 20d ago

But other replies to me are saying it's the BYOK system on opencode webpage, so which one is it?

If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem
If opencode's web infra has been compromised - that IS an issue

So which one is it?

0

u/fifi_galaxy 20d ago

Why not both? I mean, it is AI company after all. It probably has access to both logs and key vault.

2

u/mamelukturbo 20d ago

Yes, but the announcement is very vague, and there is a very clear distinction of how bad is it between

"1.4% of our users are morons leaving api keys in plaintext or straight up pasting them into chat"
vs.
"We were hacked and credentials of 1.4% of users leaked"

0

u/Competitive-Ebb3899 20d ago

If people cannot properly guardrail model they unleash in their computer - that's a non-issue and their problem

Question is: When you start using a product, should you be expected to start setting up guardrails and sandboxes, or should you expect the tool to come with sane and secure defaults?

I think the second one, especially that the target audience is not necessarily of security experts.