Secrets in Context

Even if your provider doesn't use your data for training, putting secrets in context still sends them to that provider. Giving a remote model access to your plain-text secrets is a BIG risk and should absolutely be avoided.

Now, if you're running a model locally on your own hardware, the risk is much lower because at least the secret isn't leaving your machine. But even then, you should be careful about what secrets you put into context: you might accidentally reuse that session later with a different model. Also, your session history gets saved on disk, so if a session includes a plain-text secret, now there's another copy of it to worry about.

OpenCode's default permissions allow read for most files, but .env files ask for your approval by default.

The filesystem tools built into OpenCode also ask for approval before accessing paths outside the active project, but the shell tool is different: it runs with your user's host permissions, so treat shell access as real terminal access, not as a filesystem sandbox.

Not all secrets are in .env files. You can still leak secrets by:

• Pasting API keys directly into the chat
• Approving a shell command that prints secret values
• Letting logs dump authentication tokens into the terminal
• Allowing OpenCode to run a script that accesses other parts of the filesystem
• Copying or exporting a contaminated session into another system

Tune your permissions to deny reads of files you use for secrets, or require explicit approval. For example, this rule in opencode.jsonc blocks the read tool from opening .secrets files:

{
  "$schema": "https://opencode.ai/config.json",
  "permissions": [
    { "action": "read", "resource": "*.secrets", "effect": "deny" },
  ],
}

And just be careful. No single list can cover all the potential ways to leak secrets into context. If you notice a risk of leaking secrets in one of your projects, make a change to your workflow.

Outright block OpenCode's read tool from opening the project's (fake) .env secret.

1. Tell OpenCode to append a permission rule denying read for *.env in opencode.jsonc.
2. Tell it to read .env with the read tool. Confirm that access is denied.

Tell OpenCode to run and submit the CLI tests from the project root.