I am the author of this post. Looks like OpenCode fans / team is not happy with this post coming on the first page of HN. It has already been flagged by many. I never ask for upvotes, but would be great if you can upvote it. Thanks!

The title should say "OpenCode Console" not "OpenCode".

Yeah that’s a big difference

How did you determine that it has been "flagged by many"?

Interesting, #1 raw rank yet never made it past ~#10 - haven’t seen that specifically: https://news.social-protocols.org/stats?id=50133401

Thanks for the detailed metrics. This proves my point...

It's clearly heavily down voted, just look at when it was added, how many points it has and its relative position.

You cant downvote HN posts (comments you can)

They presumably meant that it’s been downranked relative to what you’d expect from a post with that many upvotes in that short of a time frame. Hundreds of upvotes in a few hours is usually a top 5 post

Afaik flagging acts like a super-downvote as far as the algorithm is concerned

Yes flagging is super downvote

The post was visible when I am logged in. But when I opened the /newest page on incognito the post wasn't there.

It’s #14 on homepage when not logged in, same as when logged in.

Now it is

Pretty pathetic if true. Imagine if they spent as much effort securing their systems as they spend brigading and astroturfing after getting 0wned.

Then next time do a less clickbait-y title: OpenCode had a leak of API keys for their service that is similar to OpenRouter; this does not affect most users.

It's a little more than that. It seems that keys for OpenAI / Anthropic APIs that were STORED on OpenCode's OpenRouter-like backend got leaked – which additionally means that OpenCode has no ability to refund people for their losses.

> which additionally means that OpenCode has no ability to refund people for their losses.

If they took payment, they are liable and they must have the ability to refund.

I guess Anthropic and OpenAI might refund based on good will.

... no, I don't think so? Taking payment for <X> (providing a proxy/platform for hosting/proxying to agents) doesn't mean that you're inherently liable for <Y>, if <Y> is 'bring your own key from a third-party provider'.

Agree, they won't refund. But they might if the total damage is < $100K