Please do not report security vulnerabilities through a public issue.
Use the repository's private vulnerability reporting page instead.
Include reproduction steps, affected versions, and the expected security impact. You should receive an acknowledgement within seven days.
Store persistent connection details only in OpenCode's global user config, not
in a project's opencode.json. Restrict that global config to the current user
when it contains an API key.
The plugin also supports CLIPROXY_API_KEY for environments where secrets are
injected at runtime. Never commit CLIProxyAPI keys to a repository.