Go subscriber: key revoked with no expiry date set; no formal compensation policy published for the Console breach #56833

Summary

I am an OpenCode Go subscriber and one of the users hit by the Console breach disclosed on Oct 17, 2026. My API key was revoked and my agent stopped working, reporting "This API key has expired." I want to raise three things that the current disclosures do not cover, and ask for a formal compensation policy.

What happened to me

I had no external providers linked. My Console workspace never held an OpenAI, Anthropic, Google or other provider key — the only credential in it was my own OpenCode Go key. So the "third party provider keys may have been exposed" framing does not describe my case at all. My key was revoked regardless.

• My key had no expiry date set. It was not scheduled to expire.
• On Oct 18, 07:31 CST (Oct 17 23:31 UTC), my very first request of the day failed with 401 api_key_expired, and it has failed on every request since.
• The key disappeared from my account — I could not view, renew, or rotate it. I had to create a new one from scratch.
• During this window my Go subscription was paid for and unusable: Console API, Inference API, Go, Pay-as-you-go and Free inference were all listed as degraded on the status page from Oct 16, 09:34 UTC.

This matches the report in #56556 exactly, including the detail that the key had no expiration date:

"I had been regularly using an API key with no expiration date, but a few minutes ago, the agent informed me that the API key has expired. I checked my account and, to my surprise, found that the API keys have disappeared."

The part that is not explained

The breach email and the public statement both frame this as a third-party provider key issue — keys that users linked from OpenAI, Anthropic, Google, and so on:

"Third party provider keys (eg OpenAI, Anthropic) saved in your workspace may have been exposed."

But OpenCode's own keys were revoked too, including keys with no expiry date. Other users have raised the same point publicly. That is a different class of event from "a third-party key you linked may have leaked," and as far as I can tell it has not been acknowledged or explained:

1. Why were first-party OpenCode / Go keys revoked? If the compromised system only held third-party provider credentials, why did users' own Console keys stop working?
2. How many keys were affected? The figure shared so far covers third-party provider keys. It does not cover how many Console or Go subscription keys were revoked.
3. Why does the status page show no security incident? The status page lists availability incidents but no security entry, which makes the incident hard to reference later.
4. Why were users with no linked provider affected at all? I linked nothing. My workspace held only my Go key. If the compromised legacy system contained third-party provider credentials, why was a first-party Go key revoked as part of the same incident?
5. How was access obtained, and when was it detected? This has not been published.

Compensation

So far the only statement about compensation I can find is a reply on a personal X account, not a formal OpenCode or Anomaly announcement. There is no published policy covering:

• Direct charges from leaked third-party provider keys (users have publicly reported losses in the hundreds and, in one case, ~$1,700 — those need a published process, not case-by-case replies).
• Subscription time lost by subscribers whose keys were revoked during the outage. I paid for a working subscription and could not use it. Whether or not the key itself was exposed, the service was not delivered.
• What happens to users with no third-party key linked at all. This is my case. I linked no external provider, so no key of mine was exposed. I still lost my key and my service. The current language covers only "exposed provider keys," which excludes everyone in my situation.

Being revoked is worse than being exposed, in practical terms: an exposed key can be rotated, whereas mine simply vanished from my account with no way to view, renew or rotate it. I had to build a new key from scratch, then go and update every consumer of the old one.

What I am asking for

1. A formal announcement — a blog post, GitHub security advisory, or pinned issue, rather than replies from individual accounts. Right now there is no single authoritative document, and the status page records nothing.
2. A published compensation policy that explicitly covers:
   • reimbursement for unauthorized third-party provider charges, with a defined process and deadline;
   • a pro-rata refund or service credit for subscription time lost while Console was unavailable, applied automatically rather than on request;
   • the case of Console/Go keys revoked with no expiry date set, which is what happened to me and others.
3. Disclosure of scope — how many Console and Go subscription keys were revoked, and whether any data beyond provider credentials was in the affected legacy system. Notably, some of us had no provider credentials in that system, so its contents were not limited to third-party keys.
4. A clear statement on remediation — what is being changed so a decommissioning legacy system cannot reach live credentials again.

Why I am asking here

I understand account and billing matters are handled by email rather than GitHub issues, and I will also write to help@anoma.ly. But the scope, the disclosure, and the compensation policy are not account-specific questions — they affect every Console and Go subscriber who was locked out, and they deserve a public answer.

Thank you.