How we keep API keys out of reach of our agents (after the OpenCode key leak)
After the OpenCode key leak, one team's rule is absolute: the agent never sees a raw key. External calls route through a small proxy that holds the credentials, so the agent only ever requests an action, never a secret — and a key that can't be exfiltrated can't leak through a log, prompt, or paste.