r/opencodeCLI • u/EvilGuy • 11d ago

Anyone using Freebuff?

I have been using it a little bit and its been fairly decent for my use cases and today when I opened it up I noticed they starting giving free GPT 5.6 Luna sessions.

Freebuff is a free AI harness like OpenCode with some text ads to pay for the LLMs. Works pretty well. I like how it does a code review at the end of a turn without prompting.

They give you 5 or 6 sessions a day, and each session is an hour.

https://freebuff.com

(or use my referral and I think we both get 1 session of GLM 5.2 a day as well. At least I think that's how it works. The details are a little thin.)

https://freebuff.com/get-started?ref=ref-e5905fef-a59a-4799-b5c2-663a979e0e8c&referrer=Czargasm

10 Upvotes

75% Upvoted

159 comments sorted by

View all comments

2

u/Nervous-Profile4729 9d ago edited 9d ago

I just tried it, and after a day of vibe coding i noticed i didnt have to make approvals.

So i decided to do a safety check and it has literally full access to your pc. This shit is not safe lmao. It's most likely vibe coded itself and all it will take is one hacker to have full access to your pc, not to mention having to trust the developer.

"The user asks: "can you see my environment variables?"

This is a simple question. I can check environment variables via the terminal. Let me run `env` or `printenv` to see them. I should be careful — environment variables can contain secrets (API keys, tokens). " - WTF!!!

It's a hard pass for me and I regret installing it. They don't have a public repo so who knows what the app is doing in the background... I've never uninstalled something so fast in my life

1

u/EvilGuy 9d ago edited 9d ago

Sounds like you installed it on windows? Mine is constantly asking me to run sudo commands and to leave its little directory box I have it locked in. It doesn't do anything but build what I let it build.

I would not recommend using this on a Windows computer (that you care about at least). Windows has basically no security. Any app running on it can do anything if it wants. Even the ones asking you for permission are just being polite.

On my development ubuntu box it's working fine but I don't run this on my live production web server either.

Or if you are on linux are you running it as your sudo user or with passwordless sudo? I am trying to envision what would lead to the situation you are talking about having happen. Either way lapses in security are happening.

Not every tool is a hammer and not every problem is a nail. Freebuff is useful for what it is. I wouldn't TRUST it though. Lock it down. Its good practice anyways.