Evidence record / opencode
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-opencode-hosted-github-bridge-authentication-surfaces-are-narrowed-or-removed
Hosted GitHub/bridge authentication surfaces are narrowed or removed. GitHub App tokens are scoped to the verified repository. The unauthenticated Feishu bridge route is removed, as is the PAT-to-installation-token exchange route. All first appear in v2.1.3, absent from v2.1.2. GitHub mock execution changes from MOCK_TOKEN exchange to direct TOKEN use; ordinary Actions retain OIDC exchange.
Channel: tagged-release. Half: both. Date: 2026-10-21.
Operator consequence: Adapt self-hosted automation that calls removed routes and check the actual deployed token audience/scope. This is primary evidence of attack-surface reduction and a compatibility change. It does not establish the Console incident’s cause, affected keys, remediation time, or deployment completion.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-opencode-hosted-github-bridge-authentication-surfaces-are-narrowed-or-removed
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-opencode-hosted-github-bridge-authentication-surfaces-are-narrowed-or-removedgithub.com/anomalyco/opencode/commit/f9098c96105bf5f6cbdb859c6e9f2045666d07d7commit2026-10-24-opencode-hosted-github-bridge-authentication-surfaces-are-narrowed-or-removedgithub.com/anomalyco/opencode/commit/0c6be8694894dc96b87c5a7b773d52e57ddaa1b2commit2026-10-24-opencode-hosted-github-bridge-authentication-surfaces-are-narrowed-or-removedgithub.com/anomalyco/opencode/commit/17ebb66d2557be741275b8d14f4e0997885f80d0
Versioned source: run artifact