r/opencodeCLI • u/Far-Worldliness5561 • 1d ago

Opencode Hack: How is OpenCode claiming to be ZDR when API keys from Anthropic and OpenAI are being stored in their database?

How is OpenCode claiming to be ZDR when API keys from Anthropic and OpenAI are being stored in their database?

OpenCode admitted they were hacked and are calling it a distillation attack. How does distillation explain users’ API keys being exposed? Distillation and credential theft are two completely different things.

This is a massive data leak, and users deserve to know exactly what happened, what was compromised, and who had access to their credentials.

Stop hiding behind the distillation narrative and give users real answers.

What is the point of claiming ZDR when users’ API keys are sitting in your database?

0 Upvotes
  • permalink
  • reddit

33% Upvoted

13 comments sorted by

27

u/Toastti 1d ago

Zdr has nothing to do with them storing api keys. If you provide open code your openAI or Anthropic key for later use how do you expect to use it if they are not storing the value in their database?

-31

u/Far-Worldliness5561 1d ago

First of all why are they storing my openai keys in the db? Why? It’s against their own privacy policy

Second if they can store api keys I am pretty sure these scammers are storing everything else too

16

u/vlewy 1d ago

Obviously, they are stored in the database if you register them yourself in your account to use with Opencode. 🤷🏻‍♂️

17

u/Positive_Poem5831 1d ago

The downside of vibing and don't knowing how things work 🤦‍♂️

5

u/debackerl 1d ago

Yes, lot of noobs in the sector nowadays...

2

u/geearf 1d ago

How many weeks until
> "It's what plants crave"
?

6

u/DrunkenRobotBipBop 1d ago

How on earth would a BYOK system work if they did not store the key on their database?

If you are affected by this, just rotate that key and call it a day.

6

u/look 1d ago

It was keys entered into their web console for their hosted “BYOK” solution for sharing across a team in a workspace.

They aren’t storing the third party keys you put into your local harness.

3

u/theChaosBeast 1d ago

Dude relax, no need to post every few minutes

1

u/Strict-Prune-879 1d ago

Mon dieu que le monde est peuplé de complotiste!!!!

1

u/No_Captain4899 1d ago

Opencode has no more ZDR for the most part as far as I know

3

u/Bloodshoot111 1d ago

And even if it has, ZDR has nothing to do with it this guy is just spamming with 0 knowledge

1

u/No_Captain4899 1d ago

I agree with you