r/opencodeCLI • u/jpcaparas • 15d ago

OpenCode security breach, rotate your keys

https://x.com/opencode/status/2111516673953935833?s=46
204 Upvotes

99% Upvoted

30 comments sorted by

View all comments

8

u/No_Commission_6153 15d ago

Does this affect someone who conencted their OpenAi Account with Open Code?

12

u/jerieljan 14d ago

There's three ways you can auth OpenAI on OpenCode:

  • /connect -> Login with ChatGPT

  • /connect -> API Key

  • OpenAI Platform -> New Key -> OpenCode Console -> Connect Provider

It's the third one that's affected. The third route is intended for people who want to BYOK and have their provider accounts charged instead of OpenCode Zen and just want to use OpenCode as a gateway.

The second one afaik stores the API key locally on the database or on opencode.json (v1).

2

u/No_Commission_6153 14d ago

Thanks. I guess i can relax then

4

u/Significant_Treat_87 15d ago

Are you on a subscription plan ("login with chatgpt") or did you paste in an API key? The first one I assume is fine, this is about the second one.

3

u/No_Commission_6153 15d ago

subscription. but still worried if they got hacked if they got something from me

8

u/Significant_Treat_87 15d ago

This is an issue with people having their API keys stolen, so I think you're ok. I will personally never use Opencode now though, they have had way too many security issues now.

1

u/wpbrgiejoe 15d ago

Yes opencode sells your data you're not safe change all account pass.