Hacker News: Reyonlds96

New comment by Reyonlds96 in "OpenCode Hacked: User credentials leaked"

Reyonlds96 — Sat, 17 Oct 2026 22:59:01 +0000

It was going through zen, so they CAN see it if they want to. Same applies to anything on Zen. But, zen is ZDR. Same goes to any provider, ZDR or not, as ZDR is just an agreement. With Openai - caveats apply on Openai side itself(they retain logs regardless).

During this short period - yes. Unless it finds a valid small model, or you set one yourself - it would use the one provided by zen. or you could disable it with an invalid model altogether. Good gesture for most users and something else to others.

It's *could by the way, as this was only a short window when this was a thing. It went back to not having this fallback pretty fast, i don't think it even lasted a month.

New comment by Reyonlds96 in "OpenCode Hacked: User credentials leaked"

Reyonlds96 — Sat, 17 Oct 2026 22:50:42 +0000

It sent the prompt to a GPT-5-nano model with the max zdr you can get on openai. That was done to give people free title gen, unless they set it themselves. Title gen does not send anything but the prompt.

Maybe try a sensible approach first, cause so far this is assumed, for no reason, to be done maliciously. "to steal data" and the like.

Opencode's source code is public, so you can verify any claim against it directly.

New comment by Reyonlds96 in "OpenCode Hacked: User credentials leaked"

Reyonlds96 — Sat, 17 Oct 2026 22:30:14 +0000

I love the smell of misinformation in the morning. All it ever did was give people free model for title gen, if they didn't set one themselves. Feature you could disable or set on your own model. That was since removed, so now there is no free fallback model.

That is it. It is still private by default