> For one it had to originate from app.opencode.com

No, that was the initial mitigation! Before the vulnerability was reported, the server was accessible to the entire world with a wide-open CORS policy.

https://github.com/anomalyco/opencode/commit/7d2d87fa2c44e32...