OpenCode: Evidence and scope
Expanded web report · Related PDF snapshot: 22 October 2026 · PDF page 8
Research reviewed 22 October 2026 · Evidence and editorial planning guidance are distinguished below.
What the source establishes
OpenCode’s documentation confirms that workspaces can use customer-supplied provider API keys and that these requests are billed by the provider. The original incident statement linked in the PDF could not be retrieved during this pass. The dated report’s incident account is retained, but fresh scope or restoration claims are not independently confirmed here.
Research reviewed 22 October 2026: OpenCode Zen documentation. Incident post unavailable in this research pass; product documentation checked.
Where the evidence stops
Product documentation explains the credential relationship; it does not verify the incident, affected accounts or reimbursement eligibility.
Use this report as a dated interpretation. A vendor notice establishes what that vendor reports; a research observation establishes what the researcher observed. Neither automatically answers the account-specific question for your business. Record later changes to the source before relying on its versions, deadlines or recovery sequence.
Establish your own scope
Inventory the provider accounts connected to the console, which keys were shared, the scopes available to each, and the independent billing and audit views at the provider.
- Identify the exact service, artifact, account or device relevant to your business, with a responsible owner.
- Record whether the source applies to that asset and what evidence supports the match.
- Separate evidence of exposure, evidence of activity and evidence of business impact. Leave unanswered questions explicitly open.
What would change the assessment?
Confirm the retired credential no longer works, the replacement has the intended scope, and unusual usage can be detected in the authoritative provider account.
Revisit the decision when the provider changes scope, a new account-specific notice arrives or local evidence contradicts the current assumption. Preserve the earlier conclusion and the reason it changed. Do not silently turn a precaution into a confirmed breach, or an absence of telemetry into proof of safety.
Decision checkpoint
Restore the integration when its owner accepts the current vendor guidance and the business can observe and limit the new credential’s use.