anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-24 04:01:10 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

How does opencode handle security checks? #2530

New Issue
Open
opened 2026-02-16 17:36:07 -05:00 by yindo · 5 comments
yindo commented 2026-02-16 17:36:07 -05:00
Owner
Copy Link
Copy Source

Originally created by @qu4n on GitHub (Nov 3, 2025).

Originally assigned to: @rekram1-node on GitHub.

Question

I noticed the "Security" blank for this project. So I implemented a fork to add some code scanning workflows: here. There appears to be a substantial number of vulnerabilities, some of which is critical:

Image

Is this being worked somewhere else?

Originally created by @qu4n on GitHub (Nov 3, 2025). Originally assigned to: @rekram1-node on GitHub. ### Question I noticed the "Security" blank for this project. So I implemented a fork to add some code scanning workflows: [here](https://github.com/qu4n/opencode/security/code-scanning). There appears to be a substantial number of vulnerabilities, some of which is critical: <img width="2138" height="1070" alt="Image" src="https://github.com/user-attachments/assets/49b01cd6-ed28-4d4f-9317-8863f7b52f99" /> Is this being worked somewhere else?
yindo commented 2026-02-16 17:36:07 -05:00
Author
Owner
Copy Link
Copy Source

@github-actions[bot] commented on GitHub (Nov 3, 2025):

This issue might be a duplicate of existing issues. Please check:

  • #2887: Both issues identify missing security practices and ask if security measures are being implemented elsewhere. #2887 focuses on NPM publishing and supply chain security while this issue covers code scanning vulnerabilities.
  • #2748: Addresses security vulnerabilities in the permission system where MCP tools can bypass permission controls
  • #3585: Proposes security enhancements through pattern-based directory access restrictions to prevent exposure of sensitive files

Feel free to ignore if none of these address your specific case.

@github-actions[bot] commented on GitHub (Nov 3, 2025): This issue might be a duplicate of existing issues. Please check: - #2887: Both issues identify missing security practices and ask if security measures are being implemented elsewhere. #2887 focuses on NPM publishing and supply chain security while this issue covers code scanning vulnerabilities. - #2748: Addresses security vulnerabilities in the permission system where MCP tools can bypass permission controls - #3585: Proposes security enhancements through pattern-based directory access restrictions to prevent exposure of sensitive files Feel free to ignore if none of these address your specific case.
yindo commented 2026-02-16 17:36:07 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 3, 2025):

I think some of these aren't actually as big a deal as they seem but there are some low hanging fruit and we shouldn't have blank security for this so I will take a look.

@rekram1-node commented on GitHub (Nov 3, 2025): I think some of these aren't actually as big a deal as they seem but there are some low hanging fruit and we shouldn't have blank security for this so I will take a look.
yindo commented 2026-02-16 17:36:07 -05:00
Author
Owner
Copy Link
Copy Source

@qu4n commented on GitHub (Nov 4, 2025):

I think some of these aren't actually as big a deal as they seem but there are some low hanging fruit and we shouldn't have blank security for this so I will take a look.

Awesome! Feel free to add these automated workflows. It would be good practice to perform these periodically to catch emerging threats/vulnerabilities.

@qu4n commented on GitHub (Nov 4, 2025): > I think some of these aren't actually as big a deal as they seem but there are some low hanging fruit and we shouldn't have blank security for this so I will take a look. Awesome! Feel free to add these automated workflows. It would be good practice to perform these periodically to catch emerging threats/vulnerabilities.
yindo commented 2026-02-16 17:36:07 -05:00
Author
Owner
Copy Link
Copy Source

@rekram1-node commented on GitHub (Nov 4, 2025):

@qu4n I can't see what workflows you setup: https://github.com/qu4n/opencode/security/code-scanning

This appears to be private

@rekram1-node commented on GitHub (Nov 4, 2025): @qu4n I can't see what workflows you setup: https://github.com/qu4n/opencode/security/code-scanning This appears to be private
yindo commented 2026-02-16 17:36:07 -05:00
Author
Owner
Copy Link
Copy Source

@qu4n commented on GitHub (Nov 5, 2025):

Hmmm, I didn't realize github did this. Maybe I'll try to mirror in gitlab to leverage their SAST.

@qu4n commented on GitHub (Nov 5, 2025): Hmmm, I didn't realize github did this. Maybe I'll try to mirror in gitlab to leverage their SAST.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#2530
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?