This is interesting <github.com/OpenHands/OpenHand...
# proj-agent-canvash
hundreds-twilight-32833
09/01/2026, 11:34 AMThis is interesting github.com/OpenHands/OpenHands/pull/16898 - PR adds an import/export to backend configuration. We have a handful of issues already focused on removing local storage but wondering if this is something others have been reaching for with their multi-backend setups.
🙌 1
🤔 1
❌ 1
c
calm-artist-7206
09/02/2026, 10:56 PMI held this PR for a bit, I have a rather bad feeling about exposing all credentials, each with FULL access.
I think maybe this is a bit too much, it’s 2026, and we all know it’s not a good security practice. Maybe we can think it over: comment
đź‘Ť 1
calm-artist-7206
09/02/2026, 11:33 PMFor the record, please notice that the message says “session API keys”.
The term “session” in “session API keys” comes from the Saas: these were runtime keys in V0, relatively short-lived (for a session).
IIRC it was: one conversation = one runtime = one key.
In enterprise/cloud, they are behind another layer of auth, and they are ephemeral.
But when we have started using them in sdk/docker/openhands, they’ve morphed into long-lived tokens, and there is no other layer. This poses a challenge from a security point of view, it seems to me, and, well, may invite an unfortunate comparison.