Shipped: opencode-security-guard

An opencode plugin guarding the inference boundary: blocks and redacts secrets in 5 layers (prompts, history, system, tools, bash). 53 regex rules + entropy, cross-platform, zero deps, with a vault that rehydrates secrets locally, never exposing them.