OpenCode lost the keys that lived in its cloud. The ones on disk were fine.

A breach of OpenCode's online console exposed 1.4% of users' stored API keys — five-figure bills at 3am. The CLI users slept. The incident proved the architecture rule without needing the disputed motive.