occonfig is pre-1.0. Security fixes land on the latest release only; there is
no maintained back-port branch yet. This table will gain rows once a stable
line exists.
| Version | Supported |
|---|---|
| 0.1.x | ✅ |
| < 0.1 | ❌ |
We take security seriously. If you discover a security vulnerability in
occonfig, please report it responsibly.
- Do NOT open a public GitHub issue for security vulnerabilities.
- Preferred: use GitHub's private vulnerability reporting. Reports stay private, are tracked in one place, and let us publish an advisory once a fix ships.
- Alternative: email [email protected].
- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)
- Acknowledgment: Within 48 hours
- Initial Assessment: Within 7 days
- Resolution Target: Within 30 days for critical issues
This security policy applies to the occonfig CLI and the profile and backup
files it writes under the user's opencode configuration directory.
The tool reads and writes local JSON files. The threat surface worth naming:
- Path handling when locating the config directory and profile directory
- Backup file creation and overwrite behavior
- Any future code path that shells out or makes network calls (none today)
- opencode itself, and its config schema (report to the opencode project)
- Third-party dependencies (report to upstream, though we will bump pinned advisories)
- Security of the model endpoints a user configures;
occonfignever contacts them
When using occonfig:
- Keep your config in version control separately.
occonfigwrites backup files but does not replace your own history. - Review the diff.
occonfig useprints what changed; read it before trusting a profile you did not write. - Do not commit API keys into profiles. A profile stores model references only, never credentials. Keep it that way if you extend the format.
- Run from a trusted checkout. Until this project has releases you trust, build from source rather than piping an install script.