Security Hardening and Audit

Harden your OpenCode deployment for security. Learn permission systems, audit logging, secrets management, and compliance patterns for production environments.

Security Layers

💡 Tip: Use Ctrl + Mouse Wheel to zoom, or click the fullscreen icon

Permission System

Principle of Least Privilege

json

{
  "permissions": [
    {
      "tool": "bash",
      "allow": ["npm test", "npm run lint", "git status"],
      "deny": ["sudo *", "rm -rf *", "git push --force"]
    },
    {
      "tool": "write",
      "allow": ["src/**", "tests/**"],
      "deny": [".env*", "secrets/**", "*.key", "*.pem"]
    },
    {
      "tool": "read",
      "allow": ["**"],
      "deny": [".env*", "secrets/**"]
    }
  ]
}

Permission Patterns

Pattern	Example	Matches
Exact	`npm test`	Only `npm test`
Wildcard	`npm *`	Any npm command
Path	`src/**`	Any file in src/
Negation	`*.key`	Any .key file

Audit Logging

Enable Comprehensive Logging

json

{
  "logging": {
    "enabled": true,
    "level": "info",
    "file": "opencode-audit.log",
    "rotate": {
      "maxSize": "10MB",
      "maxFiles": 30
    }
  }
}

Log Format

json

{
  "timestamp": "2024-01-15T10:30:00Z",
  "level": "info",
  "event": "tool.execute",
  "tool": "bash",
  "args": {"command": "npm test"},
  "result": "success",
  "user": "developer1",
  "session": "abc123"
}

Analyzing Logs

bash

# Find all failed operations
grep '"result":"error"' opencode-audit.log

# Find bash commands
grep '"tool":"bash"' opencode-audit.log

# Find write operations to sensitive files
grep '"tool":"write"' opencode-audit.log | grep -E '\.env|secrets'

Secrets Management

Environment Variables

bash

# .env (never commit)
OPENAI_API_KEY=sk-your-key
ANTHROPIC_API_KEY=sk-ant-your-key
DATABASE_URL=postgresql://...

Reference in Config

json

{
  "providers": {
    "openai": {
      "apiKey": "${OPENAI_API_KEY}"
    }
  }
}

.gitignore

git

.env
.env.*
*.key
*.pem
secrets/

Network Security

API Key Rotation

bash

# Generate new key
# Update .env
# Restart OpenCode
# Verify old key is invalidated

Rate Limiting

json

{
  "providers": {
    "openai": {
      "apiKey": "${OPENAI_API_KEY}",
      "rateLimit": {
        "requests": 60,
        "window": "1m"
      }
    }
  }
}

Timeout Configuration

json

{
  "providers": {
    "openai": {
      "timeout": 30000
    }
  }
}

Compliance Patterns

Data Residency

json

{
  "providers": {
    "openai": {
      "apiKey": "${OPENAI_API_KEY}",
      "region": "us-east-1"
    }
  }
}

Data Retention

json

{
  "logging": {
    "retention": {
      "days": 90,
      "autoDelete": true
    }
  }
}

PII Redaction

json

{
  "security": {
    "redact": {
      "patterns": [
        "\\b\\d{3}-\\d{2}-\\d{4}\\b",
        "\\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\\.[A-Z|a-z]{2,}\\b"
      ],
      "replacement": "[REDACTED]"
    }
  }
}

Security Checklist

Before Deployment

Regular Audits

Review audit logs weekly
Rotate API keys monthly
Update permission rules quarterly
Review security patterns annually