alt Hacker NewsWhy are my API keys in the workspace exposed? Does OpenCode send my API keys to their backend servers??? Was this a supply chain attack that infected the opencode program itself? What is going on?
Replies
InsideOutSanta • today at 8:30 PM
The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.
pranshuchittora • today at 7:24 PM
They need to explain this, by releasing a detailed RCA.
If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.