Hacker News Reader

If you use the hosted OpenCode Console and bring your own API keys, then they'd have your keys on their backend servers.

The announcement is needlessly confusing, but if you only use the CLI, you're not affected. There is no supply chain attack.

Do you work for OpenCode? How do you know this? Every similarly sized start up would have added the statement “OpenCode Desktop users are not affected.” The fact they didn’t means they can not definitively rule that case out. It would be prudent to rotate out your third party keys in this situation, especially if it is a API key with a high drain limit.

> How do you know this?

It's in their announcement; it's just not written in a way that people immediately understand.

It sounds like most users are not affected (zen | go), and that if you are, you would have received an email. Check your OpenAi and Anthropic account for usage that was not yours.

Run a gateway like GoModel instead of uploading your keys to a vendor to prevent this class of attack in the future.

https://gomodel.enterpilot.io/ (my preferred gateway)

They need to explain this, by releasing a detailed RCA.