Report vulnerabilities privately through GitHub Security Advisories ("Report a vulnerability" on the repository's Security tab). Do not open a public issue.
The specification (spec/) is normative; in short:
- Authenticated hosts. An application host listens on
127.0.0.1only, on an ephemeral port, and requires a random 256-bit token per process, compared in constant time. The token lives in memory only: never on disk, in logs or in any client response. The plugin refuses any non-loopback address. - No public arbitrary code execution. Hosts expose a fixed table of methods; the plugin sends
{ method, args }JSON only and never imports code from the npm cache. The only exception is one declareddangerousmethod pernativeintegration, absent by default (both the application preference and the plugin optionallowCodeExecutiondefault tofalse) and gated by an OpenCode permission set to "ask" on every call. - Secrets outside the watched OpenCode configuration. No token, password or OAuth secret under
~/.config/opencode: the OpenCode credential store first, then the OS keychain, then the integration's own state directory with0600permissions. - No hard-coded organization identifiers: no Entra client or tenant ID, studio path or network share.
- Named permissions for sensitive actions: launching executables, installing the application part, attaching a session, network access from a host method.
- Supply chain. npm publication through GitHub Actions trusted publishing (OIDC) with provenance, after a manual approval; attested host archives; no npm install scripts.
| Integration | Method | Enabled when | Asked through |
|---|---|---|---|
| OpenCode for Blender | blender_execute_code: runs Python code in the attached Blender |
the OpenCode Link preference Allow code execution and the plugin option allowCodeExecution are both on (both off by default) |
the blender_execute_code permission, on every call; a refusal runs nothing |
Supplied code runs with Blender's rights and owns its undo steps: OpenCode Link neither groups nor rolls them back.
- Daemon password read by an application add-on. A headless
nativeadd-on (Blender) reads the OpenCode service registration, password included, with the user's rights, to advertise its session. That grants the add-on code full access to the OpenCode service of the same user. - Fake local host. A local process of the same user can advertise a host that passes its own handshake and inject responses into the model's context. Mitigations: consent in the application, a labelled confirmation (application, document) before any attachment, loopback only.