Security model
Trust boundary, bind defaults, authentication, redaction and the fail-closed rules.
The trust boundary is the operator machine. This is not a multi-tenant server product, and every default is chosen so that the unsafe path requires deliberate configuration.
Canonical source ↗Defaults that assume you will forget
The trust boundary is your machine. Every default is picked so that the unsafe path requires you to type something extra.
Bind
Defaults to 127.0.0.1, with localhost and ::1 accepted. Host and Origin guards apply on loopback.
Auth
Any non-loopback host requires OPENCODEVIEW_AUTH_TOKEN. Without it the process exits instead of starting unprotected.
Redaction
Secret-like keys, bearer tokens, common provider prefixes, URL userinfo and absolute home paths are replaced before serialization.
Caching
API responses are sent with Cache-Control: no-store. Nothing analytical lands in an intermediary.
Telemetry
There is none. The runtime opens no outbound product analytics connection of any kind.
Supply chain
Gitleaks runs as a mandatory gate in bun run check, alongside tests, typecheck, lint, build and dependency audit.
Exposing past loopback is an operator choice. Review the redaction rules against your own data before you make it.
Environment
| Variable | Default | Purpose |
|---|---|---|
| OPENCODE_DB | ~/.local/share/opencode/opencode.db | Source database, read-only |
| OPENCODEVIEW_CACHE | <repo>/.cache/analytics.sqlite | Derived cache |
| OPENCODEVIEW_HOST | 127.0.0.1 | API bind; non-loopback requires a token |
| OPENCODEVIEW_AUTH_TOKEN | unset | Bearer token for non-loopback /api/* |
| PORT | 4317 | API port |
| OH_MY_OPENCODE_LOG | $TMPDIR/oh-my-opencode.log | Optional live activity tail |