Back to Results

2.1.0

OpenChamber

Name: OpenChamber
Author: FedaykinDev

AI coding assistant powered by OpenCode

Programming Languages Machine Learning Other

Rank#-991

FedaykinDevopenvsx266,899Oct 1, 2026, 06:15 PMRegistryHomepageGitHub

Created: last year
Last commit: 5 days ago
Latest release: v2.0.27 days ago

Security Findings

pull_request_target with secrets

MaliciousLineage

[.github/workflows/label-merge-conflict.yml] pull_request_target with secrets

Dynamic exec of remote content (VSX)

Scanner

Fetched content reaches a dynamic exec sink in dist/webview/assets/markdownCore.js: fetch(

dist/webview/assets/markdownCore.js

OWASP-AST06

Hardcoded secrets/API keys3×

Scanner

Basic Auth Credentials: ****

Secret Keyword: setti...****

Secret Keyword: strin...****

dist/webview/assets/SettingsView.js

OWASP-AST04

Hardcoded secrets/API keys7×

Scanner

Secret Keyword: API-S...****

Secret Keyword: Passk...****

Secret Keyword: LAN-Z...****

Secret Keyword: SSH-P...****

Secret Keyword: Ander...****

Secret Keyword: Falsc...****

Secret Keyword: App-S...****

dist/webview/assets/de.js

OWASP-AST04

Hardcoded secrets/API keys7×

Scanner

Secret Keyword: Clave...****

Secret Keyword: Las c...****

Secret Keyword: El ac...****

Secret Keyword: Contr...****

Secret Keyword: OAuth...****

Secret Keyword: Usar ...****

Secret Keyword: Secre...****

dist/webview/assets/es.js

OWASP-AST04

Hardcoded secrets/API keys4×

Scanner

Secret Keyword: Clé A...****

Secret Keyword: Aucun...****

Secret Keyword: Mot d...****

Secret Keyword: Utili...****

dist/webview/assets/fr.js

OWASP-AST04

Hardcoded secrets/API keys7×

Scanner

Secret Keyword: Clien...****

Secret Keyword: API k...****

Secret Keyword: SSH p...****

Secret Keyword: API K...****

Secret Keyword: Use a...****

Secret Keyword: Incor...****

Secret Keyword: App s...****

dist/webview/assets/index.js

OWASP-AST04

Hardcoded secrets/API keys3×

Scanner

Secret Keyword: API キ...****

Secret Keyword: LAN ア...****

Secret Keyword: SSH パ...****

dist/webview/assets/ja.js

OWASP-AST04

Hardcoded secrets/API keys6×

Scanner

Secret Keyword: ****

Secret Keyword: Passk...****

Secret Keyword: LAN 접...****

Secret Keyword: SSH 비...****

Secret Keyword: UI 비밀...****

Secret Keyword: API K...****

dist/webview/assets/ko.js

OWASP-AST04

Hardcoded secrets/API keys7×

Scanner

Secret Keyword: API-s...****

Secret Keyword: SSH-w...****

Secret Keyword: UI-wa...****

Secret Keyword: OAuth...****

Secret Keyword: Een a...****

Secret Keyword: Onjui...****

Secret Keyword: App-g...****

dist/webview/assets/nl.js

OWASP-AST04

Hardcoded secrets/API keys7×

Scanner

Secret Keyword: Введі...****

Secret Keyword: Ключ ...****

Secret Keyword: Ключі...****

Secret Keyword: Для L...****

Secret Keyword: Задат...****

Secret Keyword: API к...****

Secret Keyword: OAuth...****

dist/webview/assets/uk.js

OWASP-AST04

Hardcoded secrets/API keys4×

Scanner

Secret Keyword: SSH 密...****

Secret Keyword: OAuth...****

Secret Keyword: API K...****

Secret Keyword: API 密...****

dist/webview/assets/zh-CN.js

OWASP-AST04

Hardcoded secrets/API keys

Scanner

Secret Keyword: API 金...****

dist/webview/assets/zh-TW.js

OWASP-AST04

Hardcoded secrets/API keys9×

Scanner

Secret Keyword: Klucz...****

Secret Keyword: OAuth...****

Secret Keyword: Dostę...****

Secret Keyword: API K...****

Secret Keyword: Hasło...****

Secret Keyword: Użyj ...****

Secret Keyword: Wpisz...****

Secret Keyword: Ta se...****

Secret Keyword: Sekre...****

dist/webview/assets/pl.js

OWASP-AST04

Hardcoded secrets/API keys5×

Scanner

Secret Keyword: Chave...****

Secret Keyword: Senha...****

Secret Keyword: Defin...****

Secret Keyword: OAuth...****

Secret Keyword: Usar ...****

dist/webview/assets/pt-BR.js

OWASP-AST04

Hardcoded secrets/API keys10×

Scanner

Secret Keyword: API a...****

Secret Keyword: Passk...****

Secret Keyword: LAN e...****

Secret Keyword: SSH ş...****

Secret Keyword: API A...****

Secret Keyword: OAuth...****

Secret Keyword: UI şi...****

Secret Keyword: Başka...****

Secret Keyword: Şifre...****

Secret Keyword: Uygul...****

dist/webview/assets/tr.js

OWASP-AST04

Sensitive file access2×

Scanner

Access to sensitive file: homedir(),".gnupg","S.gpg-agent.ssh");if(await xh(t))return t;let r=async n=>{for(let i of rj)try{let{stdout:s}=await tj...

Access to sensitive file: ~/.ssh

OWASP-AST03

Dangerous security bypass flags

Scanner

Bypass flag in content: --trust

OWASP-AST06

Workflow makes outbound network call

Lineage

[.github/workflows/bot-summarize.yml] curl -fsSL https://opencode.ai/install