Repository navigation
security: OPENCODE_SERVER_PASSWORD is kept in process env post consumption #14567
Description
Description
OPENCODE_SERVER_PASSWORD continues to be stick around in the process's env. When running headless in docker, the only way to set OPENCODE_SERVER_PASSWORD is to put it in the env at start, but this should be removed once consumed, as a security measure to avoid potential future leakage into spawned processes.
Plugins
No response
OpenCode version
v1.2.10
Steps to reproduce
No response
Screenshot and/or share link
No response
Operating System
Docker
Terminal
No response
Activity
[-]OPENCODE_SERVER_PASSWORD is kept in process env post consumption[/-][+]security: OPENCODE_SERVER_PASSWORD is kept in process env post consumption[/+]github-actions commentedon Apr 23, 2026
To stay organized issues are automatically closed after 60 days of no activity. If the issue is still relevant please open a new one.