Seems that OpenCode is YC-backed as well [0] [1]. I would've thought YC would encourage better cyber security practice than OpenCode have demonstrated here.
[0]: https://www.ycombinator.com/companies/sst
[1]: https://anoma.ly/
[0]: https://www.ycombinator.com/companies/sst
[1]: https://anoma.ly/
I have no idea where you got your internal image of YC-backed companies from, but it needs massive adjusting.