How does opencode handle security checks? #3824

Activity

1. github-actions commented on Nov 3, 2025

   

   github-actionsBot

   on Nov 3, 2025 – with GitHub Actions

   Contributor

   More actions

   This issue might be a duplicate of existing issues. Please check:

   • Adopt Trusted Publishing and Supply Chain Security Best Practices #2887: Both issues identify missing security practices and ask if security measures are being implemented elsewhere. Adopt Trusted Publishing and Supply Chain Security Best Practices #2887 focuses on NPM publishing and supply chain security while this issue covers code scanning vulnerabilities.
   • feat: Add Permission Control for MCP Tools #2748: Addresses security vulnerabilities in the permission system where MCP tools can bypass permission controls
   • Add pattern-based directory access restrictions to prevent verbose per-tool configurations #3585: Proposes security enhancements through pattern-based directory access restrictions to prevent exposure of sensitive files

   Feel free to ignore if none of these address your specific case.
2. rekram1-node

   self-assigned this

   on Nov 4, 2025
3. rekram1-node commented on Nov 4, 2025

   

   rekram1-node

   on Nov 4, 2025

   Contributor

   More actions

   I think some of these aren't actually as big a deal as they seem but there are some low hanging fruit and we shouldn't have blank security for this so I will take a look.
4. qu4n commented on Nov 4, 2025

   

   qu4n

   on Nov 4, 2025

   Author

   More actions

   I think some of these aren't actually as big a deal as they seem but there are some low hanging fruit and we shouldn't have blank security for this so I will take a look.

   Awesome! Feel free to add these automated workflows. It would be good practice to perform these periodically to catch emerging threats/vulnerabilities.
5. rekram1-node commented on Nov 4, 2025

   

   rekram1-node

   on Nov 4, 2025

   Contributor

   More actions

   @qu4n I can't see what workflows you setup: https://github.com/qu4n/opencode/security/code-scanning

   This appears to be private
6. qu4n commented on Nov 6, 2025

   

   qu4n

   on Nov 6, 2025

   Author

   More actions

   Hmmm, I didn't realize github did this. Maybe I'll try to mirror in gitlab to leverage their SAST.
7. thdxr

   closed this as completedon Mar 25, 2026