alt Hacker NewsDid both of you intentionally skip the part of the article about the critical security issues?
Replies
troyvit • yesterday at 2:42 PM
There were 3,905 words above any mention of an RCE. Can you blame them?
➕ show 1 reply
awinter-py • yesterday at 1:52 PM
I use nono.sh for sandboxing -- I think a lot of power users are using sandbox + YOLO mode because approval prompts slow them down
yes it's bad if the permission system is broken, but serious users have not trusted this stuff for a while, find the built-in permissions layer burdensome, and are already using a safety layer somewhere else
➕ show 1 reply
The RCE they mention was fixed in December, 2025:
https://github.com/anomalyco/opencode/releases?page=21#relea...