Web/serve config endpoint exposes resolved provider and MCP secrets to authenticated clients #22157

Description

In serve/web mode, GET /config returns fully resolved configuration values to the browser, including secret material that should remain server-side.

In our environment, the returned config payload included:

• resolved provider apiKey
• resolved MCP environment variables such as GITEA_TOKEN

This was returned to an authenticated web client. Even with authentication in front of the UI, returning shared runtime secrets to the browser is unsafe because those secrets are intended for server-side execution, not for all authenticated clients to read.

Expected behavior:

• config returned to browser clients should redact or omit sensitive values
• secret placeholders may remain visible structurally, but resolved secret values should not be sent to the client

Actual behavior:

• the browser-facing config endpoint returned the resolved secret values directly

Plugins

Build-local plugins:

• secret-guard.js
• workspace-shell.js

OpenCode version

1.3.15

Steps to reproduce

1. Run OpenCode in serve/web mode with a provider configured via environment-backed secrets.
2. Configure any MCP server that also uses environment-backed secrets.
3. Authenticate to the web UI.
4. Request GET /config from the same authenticated client session.
5. Observe that the JSON response contains resolved secret values instead of redacted placeholders.

Screenshot and/or share link

No screenshot attached because the response contained live secrets.

We verified this through the browser-facing launcher path and confirmed the returned JSON included resolved secret material.

Operating System

Linux (Kubernetes pod on Fedora CoreOS host)

Terminal

Web UI / serve mode behind a reverse proxy launcher