docs: restore security scope wording

docs: restore no-sandbox paragraph
docs: describe v2 permissions and server auth
2026-10-02 13:36:22 +00:00 · 2026-10-02 01:24:18 +00:00 · 2026-10-02 01:00:17 +00:00 · 2026-10-02 00:42:49 +00:00
1 changed files with 4 additions and 1 deletions
@@ -20,7 +20,10 @@ If you need true isolation, run OpenCode inside a Docker container or VM.

 ### Server Mode

-Server mode is opt-in only. When enabled, set `OPENCODE_SERVER_PASSWORD` to require HTTP Basic Auth. Without this, the server runs unauthenticated (with a warning). It is the end user's responsibility to secure the server - any functionality it provides is not a vulnerability.
+OpenCode clients normally discover or start a local background HTTP service. The CLI binds to loopback by default and
+supplies a generated HTTP Basic Auth password when one is not configured; its server process refuses to start without a
+password. If you expose the service beyond your machine, use appropriate network access controls as well as authentication.
+An application embedding the fetch handler without a password must provide its own access control.

 ### Out of Scope
Author	SHA1	Message	Date
rekram1-node	5fbdf3ee60	docs: restore security scope wording	2026-10-02 01:24:18 +00:00
rekram1-node	4827ef1f27	docs: restore no-sandbox paragraph	2026-10-02 01:00:17 +00:00
rekram1-node	2dedc5e274	docs: describe v2 permissions and server auth	2026-10-02 00:42:49 +00:00