opencode-security is a security scanning tool, so it is held to the standard it applies to other people's code. If you find a vulnerability in the plugin itself, report it.

Report security issues privately by opening a security advisory at https://github.com/anomalyco/opencode-security/security/advisories/new.

For issues related to OpenCode itself (not this plugin), use the main OpenCode security reporting channel: https://opencode.ai/security.

Do not open a public GitHub issue for a security report. Include what you can of: the plugin version from package.json, your platform and OpenCode version, reproduction steps, and the impact you believe it has.

In scope: a vulnerability in the plugin's own code - its scripts, workflows, agent definitions, and hooks.

Out of scope: findings the scan produces about your code (best-effort by design, so a missed vulnerability there is a quality issue, not a plugin vulnerability); the behavior of OpenCode's underlying models themselves; and anything downstream of a hostile repository, per the trust model below.

The code you scan is trusted. A scan and a fix run in your OpenCode session, under your permissions, with no isolation layer of the plugin's own - so the repository's .git/config, its .opencode/ settings and hooks, and everything else your session loads from that directory apply as usual. The plugin does not attempt to stop a hostile repository from influencing a scan.

To work with code you do not fully trust, sandbox the whole session first. Use your preferred sandboxing approach - container, VM, or OS-level restrictions.

Security fixes land on the latest released version of the plugin. There are no long-lived support branches. Update to the newest version before reporting.