OpenCode's leak was Console, not your CLI
A developer's audit of the OpenCode credential leak found that the exposed system was OpenCode Console, an optional hosted service that stores provider API keys for workspace sharing, not the locally run coding agent. Th…