Repository navigation
Sign-in alert reports São Paulo for a login from Chapecó, SC #63769
Description
Description
An OAuth sign-in alert reported the location as São Paulo, Brazil, for a sign-in I made from Chapecó, Santa Catarina. The unexpected city made a legitimate sign-in look suspicious and caused unnecessary concern about account security.
I switched to a second OpenCode account after exhausting the tokens on my first account. The email reported Windows/Chrome and 12 November 2026 at 00:42 UTC (11 November at 21:42 local time). Local OpenCode logs show the CLI starting in that same minute. The IPv6 in the alert shares its first 64 bits with my current Windows public IPv6; two independent IP geolocation services currently locate the alert IP in Chapecó. These observations strongly support that the sign-in came from my network, though they do not prove the identity of the person who signed in.
Please check the geolocation used for security alerts. It would also help to explicitly describe the location as approximate, or show a broader region when city-level confidence is low. I can provide the full IP and alert privately if needed; I am withholding it here for privacy.
Steps to reproduce
The issue was observed once: switch accounts and sign in using OAuth from the affected connection, then inspect the sign-in alert. I have not confirmed whether it reproduces consistently.
OpenCode version
2.2.7
Operating System
Windows / Chrome; local CLI running under WSL.
Activity
opencodejr commentedon Nov 13, 2026
Thanks for the detailed report, and for keeping the IP out of a public issue.
You're asking for the sign-in alert email to say that its location is approximate, or to show a broader region (such as the state or country) when the city is uncertain. That way a legitimate sign-in, like yours from Chapecó that was shown as São Paulo, doesn't look suspicious. I've filed this as a feature request, and the maintainers will consider it.
I searched for the code and docs that produce these alerts and their location, and found nothing in this repository. I couldn't find any existing issue about this either.
If you ever think a sign-in really wasn't yours, please email help@anoma.ly with the full alert details. Account details shouldn't go in this public issue.