The first extension I add to any coding agent is one that redacts or rejects any read/write of a secret or credential or credential file. It's annoying, and the agent can work around it, but better to add a weak guardrail than none at all. Best is to not give it access to any secrets, but that's not always possible.

Here's a few for Pi: https://pi.dev/packages/@k3_2o/pi-secrets https://pi.dev/packages/@spences10/pi-redact https://pi.dev/packages/keyshroud

A couple for OpenCode: https://github.com/boxpositron/envsitter-guard https://github.com/kenryu42/cc-safety-net https://github.com/inkdust2021/opencode-vibeguard