Do you work for OpenCode? How do you know this? Every similarly sized start up would have added the statement “OpenCode Desktop users are not affected.” The fact they didn’t means they can not definitively rule that case out. It would be prudent to rotate out your third party keys in this situation, especially if it is a API key with a high drain limit.
> How do you know this?
It's in their announcement; it's just not written in a way that people immediately understand.