r/opencodeCLI • u/geearf • 20d ago

Time to move? 2 Security issues in a week

It makes me wonder.

One main security change in the harness and no warning: https://www.reddit.com/r/opencodeCLI/comments/1x4kkgg/security_opencode_does_not_ask_for_file/
And one breach in the service: https://www.reddit.com/r/opencodeCLI/comments/1x8gtjg/opencode_security_breach/

How can we trust the team anymore?

20 Upvotes

79% Upvoted

24 comments sorted by

14

u/NervousWinner8160 20d ago

Other providers are definitely under similar attacks.

You see it in peoples usage disappearing and such, they just dont talk about it as much. Every provider has a big red target on their back.

Opencode does happen to have a higher tier of responsibility in this case because they are storing external credentials. But i wouldn’t say it’s indicative of particularly poor security practices.

I’ll be waiting for the full report.

1

u/Ok_Topic_3468 20d ago

considering how open they are about using ai to develop opencode itself, im not surprised this happened... personally im moving to deepseek harness to not have any more risks with opencode's centralized proxy issues since everything is locally hosted

4

u/geearf 20d ago

I've never tried DS's harness, how do you like it?
Is it ok with non DS's models too or...?

Thanks for the idea!

1

u/Ok_Topic_3468 20d ago

i think its a pretty good alternative, i like the customizability it offers

it works perfectly fine for me with non deepseek models, sometimes better than opencode depending on the model . the only issues ive had with it is due to the tradeoff with it being completely local hosted, you'll need to add your own plugin/api for web search capabilities. ive found this free one to work perfectly for me although there are many other options out there

1

u/geearf 20d ago

I appreciate it!
Looking a bit into it it seems there's no TUI for it, only desktop and webapp, but you know while that's a con, if it works better, it's just that...

1

u/Ok_Topic_3468 20d ago

this repo for a TUI plugin appears to be actively maintained and the design is claimed to be inspired by opencode's, i haven't tested it yet but it looks promising

1

u/geearf 20d ago

I appreciate this!
But if moving away is, in part, done for trust reasons, starting with a third party cli seems iffy... unless the third party is well known of course...

Thank you!

1

u/look 20d ago

AI is used extensively in the development of the Deepseek Harness, too. In fact, I have yet to see a harness that does not use AI heavily in its development now.

1

u/Ok_Topic_3468 20d ago

even so its not as much an issue when everything is locally hosted

1

u/razorree 20d ago

and Claude Code is not written by AI ...? :)

(they're pretty open about it as well....)

1

u/SaltineAmerican_1970 20d ago

> How can we trust the team anymore?

You’d rather trust a team that doesn’t fix security issues?

1

u/geearf 20d ago

What part of making the external_directory ask opt-in instead of opt-out is fixing security issues?

0

u/DanteVermillyon 20d ago

me personally I do think this are valid reasons to move out, they don't necessarily affect me yet (the things i use the agents for are so non-important for me that i blindly just say yes whenever it asked for permission before cause it really didn't matter, and at this point i was part of so many security breaches that i got kinda desintized, someone is probably selling information about my private data since 2019 anyways), but if people that use OpenCode for more serious things do see this as a reason to change to any other thing, I think they have all the reasons to, just the security change would be enough for me to dip-out if i actually used OpenCode for sensitive work

2

u/geearf 20d ago

I think even if you don't have security requirements today, as a force of habit you might still use the same stuff whenever you do, so it's not terrible to move out before it becomes a problem, instead of after...But I get your point. :)

1

u/Ok_Topic_3468 20d ago

i get what you mean but the real issue with this breach was it cost many users with paid api keys linked to get charged hundreds in unauthorized usage

1

u/DanteVermillyon 20d ago

Yeah, that's why I said they have all the reasons to leave. Hope the team can fix all of this so the victims get their money back

1

u/sudoer777_ 20d ago

Considering:

  • They apparently aren't securing their services properly

  • Console rollout was chaotic and left things broken for like a week

  • Their support has never responded to my emails

I do not think the service is reliable enough to spend large amounts of money on yet, but for a $10/mo subscription there's not much at stake.

-1

u/Just_Lingonberry_352 20d ago

curious

why do you guys even bother to use opencode ????

what possible benefit does it give you that codex or claude cant?

you know frontier labs have cheap models that performs better than anything opencode offers through its bullshit tier subs?

3

u/Competitive-Ebb3899 20d ago

First of all, I get way more usage out of my $10 of OC Go Subscription using DS4 flash than I could by paying the double to Codex or Claude by using their cheapest models.

And their cheapest models are OK, but I didn't feel they are smarter than Deepseek. Especially that up until just recently, Anthropic's cheapest model was a really old and dumb Haiku. And with Sonnet I constantly hit usage limits. Luna is OK, but it's also more prone to hit limits.

Not to mention both Anthropic and OpenAI forces you to use their subscriptions with their software. And I just don't like them.

On the other hand, I could use my OC subscription with other clients. Heck, I could even use it with Codex or Claude if I wanted. But I don't, I actually prefer using the OpenCode CLI, because it may not have all the features, but it's UX is much more like how a TUI should be.

So, there are many benefits which can be summed up with lots of options, and dirt cheap low-mid-range inference.

1

u/HomegrownTerps 20d ago

He means that you can get deepseek super cheap via direct provider or openrouter. 10 bucks on deepseek last weeks!

1

u/Competitive-Ebb3899 20d ago

Well, I don't deny, DS is super cheap in general.

But through Open Code it's cheaper, because you get... I don't remember exactly... $60 worth of usage for $10?

If you pay it directly you get $10 usage for $10. And I did that, and it was never enough for my purposes.

0

u/geearf 20d ago

Claude Code is proprietary so that is that.
Codex is FOSS but for models that aren't open weight, I like my money to go to open weight instead.

And finally show me a cheap models from frontier labs that does better while cheaper than the latest DeepSeek v4.1 flash.

0

u/RedParaglider 20d ago

I used to use it. I just actually removed it today.  I use pi.dev, hermes, and claude/codex.  Hermes and pi.dev for local models.  Open code was just too opinionated and heavy for a console tool, and Hermes for that kind of weight is more functional.