Unverified50% confidenceFactExact time
When environment variables are used, the code directly reads plaintext credentials via process.env.XXX, and any code that can access that process may leak them.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn the OpenCode official documentation, both the .env protection example and the company.guard example register an execute.before hook only for the read tool, and do not intercept the behavior of reading files via shell commands (such as cat).63% similarUnverifiedChild processes inherit environment variables from the parent shell; opening a new terminal window starts a fresh shell process whose environment variables come from system configuration files rather than values manually set in the previous window.62% similarUnverifiedThe contents of the PATH environment variable, when read by a system call (such as execvp), do not go through the shell's expansion process, so a ~ in PATH is treated as an ordinary character-based directory.62% similarUnverifiedThe OpenCode migration table maps v1's shell.env hook to v2's ctx.shell.hook("create.before", ...), which can be used to inject variables into the command environment, but throwing an error will likewise fail the command.62% similarUnverified在Windows系统上使用多进程时需要将代码放在if __name__ == '__main__'保护块中，否则会触发递归子进程创建错误59% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1049241API
curl https://kongchang.com/api/v1/knowledge/claims/1049241MCP
get_claim(id=1049241)