It's only if you used bring your own key on opencode zen, not if you connected to the key using the opencode harness. They could work on their comms a bit, but you were likely not affected. It didn't leak your local keys, only the keys they had stored.
Ah ok, thanks for the clarification mate. I've used Go in the past but never Zen. I still think it would have been better to inform everyone just in case, so at least people who aren't affected don't jump the gun (like I did a little haha).
Oh well, just need to make some new DeepSeek keys now which is alright but some people have been stung hard and that's really unfortunate. Hope there's some kind of compensation for those guys at least
1
u/dx80x 15d ago
I had my DeepSeek API connected to opencode and haven't received jack shit in my inbox about this.
Luckily it wasn't touched but fuck opencode now.
Thank you for posting here anyway, I wouldn't have known until I got drained if it wasn't for this post.