Skip to content

Remove persisted passwords and harden local server startup - #2

Open
marceli1404 wants to merge 9 commits into
mainfrom
security-hardening-2026-10-05
Open

marceli1404 wants to merge 9 commits into
mainfrom
security-hardening-2026-10-05

Conversation

@marceli1404

Copy link
Copy Markdown
Owner

What changed

  • stop storing the OpenCode password in localStorage
  • clear passwords saved by older versions
  • keep credentials in memory only
  • stop printing the password from server-manager
  • bind the OpenCode server to 127.0.0.1 by default
  • remove automatic curl | bash installation
  • fix the server/server-manager CommonJS-vs-ESM runtime mismatch
  • use native fetch for readiness checks
  • add build/syntax CI

Behaviour change

After a page reload, the password must be entered again. This is intentional so the browser does not persist the server credential.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant