Stop Sending Your .env to OpenAI: A Privacy Layer for OpenCode

AI coding agents are the most productive and the most dangerous tools on your machine. They read your files, execute shell commands, write infrastructure code, and reason about your entire project context. To do any of this well, they need access to the real stuff: API keys, database credentials, JWTs, connection strings. The kind of values that live in .env files and should never leave your device. But they do leave your device. Every single message you send to your coding agent (including the one where you pasted your Stripe secret key to debug a webhook) is transmitted to an LLM provider's inference endpoint. The model sees everything. This is the fundamental tension: the agent needs your secrets to be useful (or at least to be autonomous), but the LLM doesn't need to see your secrets to reason about them. We built a plugin to resolve this. Today we're releasing @rehydra/opencode , a privacy layer for OpenCode that anonymizes secrets before they reach the LLM and restores them befor