On: OpenCode Hacked: User credentials leaked

But isn’t OpenCode open source why does it need credentials.

For the inference APIs, which need to bill users. It's unclear why OpenCode's servers (presumably) had access to the API credentials.

They function similar to openrouter BYOK.

Because people cut and pasted them in.

Maybe they support cloud agents.

opencode go and zen?

It does not sound like those were the systems affected by this, there is another service that lets you upload keys for Ant/OAI, where you add one key for your company and then OpenCode enables you to budget / route across vendors.

Use a gateway like LiteLLM or GoModel, don't upload keys to a vendor, they are doing too much eyes and brain free coding this year

- https://gomodel.enterpilot.io/ (my preference)

- https://docs.litellm.ai/docs/