| Version | Supported |
|---|---|
latest main / latest npm opencode-rtl-fix |
✅ |
| older releases |
Security fixes are released as new versions. If you are on an older version, upgrade and check whether the issue still reproduces before reporting.
Do not open a public issue for security vulnerabilities.
Report privately via email:
Please include:
- A description of the vulnerability and its impact.
- Steps to reproduce (configuration, opencode version, OS).
- The plugin version / commit you tested.
You will receive an acknowledgment within a reasonable time, and we will coordinate a fix and release before any public disclosure.
- The
patch/desktop scripts intentionally modify the locally installed opencode Desktopapp.asar(with backup +--unpatchrevert). They must be run explicitly by the user with admin rights; they never run automatically and never exfiltrate data. - The server plugin only transforms chat text locally and sets
OPENCODE_RTL*environment variables. It makes no network requests.