anomalyco/opencode
1
0
Fork 0
mirror of https://github.com/anomalyco/opencode.git synced 2026-07-21 17:56:33 -04:00
Code Issues 5.9k Packages Projects Releases 19 Wiki Activity

API key input exposes previously used credentials via Windows autofill #9469

New Issue
Open
opened 2026-02-16 18:12:31 -05:00 by yindo · 0 comments
yindo commented 2026-02-16 18:12:31 -05:00
Owner
Copy Link
Copy Source

Originally created by @himansharma21 on GitHub (Feb 16, 2026).

Originally assigned to: @adamdotdevin on GitHub.

Description

The OpenRouter API key field allows Windows/Chromium autofill to display previously saved API keys in plaintext.

Screenshot provided.

Do not think this is supposed to be intended behavior. Note that the autofill also showed API keys for providers other than Openrouter.

Plugins

None

OpenCode version

OpenCode Desktop v1.2.5

Steps to reproduce

  1. Save an API key for Openrouter provider
  2. Disconnect from Openrouter in the providers section
  3. Connect to Openrouter again, it will prompt you for an API key. The textfield will show autofill suggestions for previous API keys

Screenshot and/or share link

The API key field allows Windows/Chromium autofill to display previously saved API keys in plaintext.

Image

Operating System

Windows 11

Terminal

(desktop app)

Originally created by @himansharma21 on GitHub (Feb 16, 2026). Originally assigned to: @adamdotdevin on GitHub. ### Description **The OpenRouter API key field allows Windows/Chromium autofill to display previously saved API keys in plaintext.** Screenshot provided. Do not think this is supposed to be intended behavior. Note that the autofill also showed API keys for providers other than Openrouter. ### Plugins None ### OpenCode version OpenCode Desktop v1.2.5 ### Steps to reproduce 1. Save an API key for Openrouter provider 2. Disconnect from Openrouter in the providers section 3. Connect to Openrouter again, it will prompt you for an API key. The textfield will show autofill suggestions for previous API keys ### Screenshot and/or share link The API key field allows Windows/Chromium autofill to display previously saved API keys in plaintext. <img width="969" height="558" alt="Image" src="https://github.com/user-attachments/assets/aa868eaa-fb75-4511-b433-708f188440da" /> ### Operating System Windows 11 ### Terminal (desktop app)
yindo added the windowsbugweb labels 2026-02-16 18:12:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
acp
bad
bug
discussion
docs
documentation
enhancement
extension
good first issue
growth
help-wanted
mcp
model-problem
needs:compliance
nix
opentui
perf
pull-request
Mirrored from GitHub Pull Request
 tui
web
windows
zen
No Label bug web windows
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: anomalyco/opencode#9469
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?