OpenCode Hacked: User credentials leaked

Re:OpenCode Hacked: User credentials leaked by vinni2 on Saturday October 17, 2026 @02:29PM (#50133701)

But isn’t OpenCode open source why does it need credentials.

[ Parent | on HN ]

Re:OpenCode Hacked: User credentials leaked by progval on Saturday October 17, 2026 @02:32PM (#50133719)

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

[ Parent | on HN ]

Re:OpenCode Hacked: User credentials leaked by trollbridge on Saturday October 17, 2026 @04:02PM (#50134558)

Because people cut and pasted them in.

[ Parent | on HN ]

Re:OpenCode Hacked: User credentials leaked by himata4113 on Saturday October 17, 2026 @02:42PM (#50133810)

They function similar to openrouter BYOK.

[ Parent | on HN ]

Re:OpenCode Hacked: User credentials leaked by dist-epoch on Saturday October 17, 2026 @02:38PM (#50133772)

Maybe they support cloud agents.

[ Parent | on HN ]

Re:OpenCode Hacked: User credentials leaked by kelvinjps10 on Saturday October 17, 2026 @03:06PM (#50134038)

opencode go and zen?

[ Parent | on HN ]

Re:OpenCode Hacked: User credentials leaked by verdverm on Saturday October 17, 2026 @09:51PM (#50137056)

It does not sound like those were the systems affected by this, there is another service that lets you upload keys for Ant/OAI, where you add one key for your company and then OpenCode enables you to budget / route across vendors.

Use a gateway like LiteLLM or GoModel, don't upload keys to a vendor, they are doing too much eyes and brain free coding this year

- https://gomodel.enterpilot.io/ (my preference)

- https://docs.litellm.ai/docs/

[ Parent | on HN ]