Security fixes in upstream OpenCode flow through automatically:
| Channel | Update cadence |
|---|---|
| stable | on upstream stable tags |
| beta / dev | hourly rolling builds of upstream branches |
Always run the latest release for your channel.
Do not open a public issue for security problems.
Please use GitHub's private vulnerability reporting on this repository
(Security tab → Report a vulnerability), or contact the owner directly.
Include the affected version (opencode --version), channel, and reproduction
steps.
For vulnerabilities in OpenCode itself, also consider reporting upstream at https://github.com/anomalyco/opencode/security.