11–20 of 155 posts
The disclosure timeline is concerning. Reported 2025-11-17, and multiple "no responses" after repeated attempts to contact the maintainers... not a good look.
everybody is vibecoding now, and dealing with massive security issues is bad vibes.
hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
My original message was more positive but after more looking into context, I am a bit more pessimistic. Now I must admit though that I am little concerned by the fact that the vulnerability reporters tried multiple times to contact you but till no avail. This is not a good look at all and I hope you can fix it asap as you mention I respect dax from the days of SST framework but this is genuinely such a bad look espec…
the issue that was reported was fixed as soon as we heard about it - going through the process of learning about the CVE process, etc now and setting everything up correctly. we get 100s of issues reported to us daily across various mediums and we're figuring out how to manage this
i can't really say much beyond this is my own inexperience showing
I'd be curious to know what features need opencode.ai to be an allowed origin for the local server.
Earlier quoted context omitted.
My original message was more positive but after more looking into context, I am a bit more pessimistic. Now I must admit though that I am little concerned by the fact that the vulnerability reporters tried multiple times to contact you but till no avail. This is not a good look at all and I hope you can fix it asap as you mention I respect dax from the days of SST framework but this is genuinely such a bad look espec…
the email they found was from a different repo and not monitored. this is ultimately our fault for not having a proper SECURITY.md on our main repository the issue that was reported was fixed as soon as we heard about it - going through the process of learning about the CVE process, etc now and setting everything up correctly. we get 100s of issues reported to us daily across various mediums and we're figuring out ho…
Just a thought, have you tried any way to triage these reported issues via LLMs, or constantly running an LLM to check the codebase for gaping security holes? Would that be in any way useful?
Anyway, thanks for your work on opencode and good luck.
The disclosure timeline is concerning. Reported 2025-11-17, and multiple "no responses" after repeated attempts to contact the maintainers... not a good look.
hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
Why not just ask Claude to fix the security issues and make sure they don't happen again?
hey maintainer here we've done a poor job handling these security reports, usage has grown rapidly and we're overwhelmed with issues we're meeting with some people this week to advise us on how to handle this better, get a bug bounty program funded and have some audits done
Congrats on owning this, good job, respect