Security is disabled; enable security.enabled before plannin

Error message

Security is disabled; enable security.enabled before planning a scan

What it means

SecurityCoordinator.preflight() refuses to plan a security scan when the security.enabled setting is false. Security scanning is opt-in; planning consumes model/auth resources, so the coordinator gates it behind the feature flag and tells you exactly which setting to flip.

Source

Thrown at packages/coding-agent/src/security/coordinator.ts:425

				}
			}
			const snapshot: SecurityOperationSnapshot = {
				operationId,
				planId: bundle.scan.plan?.id ?? "",
				scanId: bundle.scan.id,
				phase: operationPhaseFromStatus(bundle.scan.status),
				createdAt: bundle.scan.createdAt,
				updatedAt: bundle.scan.completedAt ?? bundle.scan.startedAt ?? bundle.scan.createdAt,
				findingCount: bundle.findings.length,
			};
			if (bundle.scan.error !== undefined) snapshot.error = bundle.scan.error;
			this.#operations.set(operationId, { snapshot, promise: Promise.resolve() });
		}
	}

	async preflight(input: SecurityPreflightInput = {}): Promise<SecurityScanPlan> {
		if (!this.#host.settings.get("security.enabled")) {
			throw new Error("Security is disabled; enable security.enabled before planning a scan");
		}
		const model = input.model ?? this.#host.activeModel;
		if (!model) throw new Error("Security scan preflight requires an active model");
		const account = selectSecurityAccount(
			this.#host.authStorage,
			model.provider,
			input.credentialId,
			this.#host.sessionId,
		);
		const store = await this.#openStore(this.#host.cwd);
		const workRoot = path.join(store.projectDirectory, "work");
		await fs.mkdir(workRoot, { recursive: true, mode: 0o700 });
		if (process.platform !== "win32") await fs.chmod(workRoot, 0o700);
		const modelRef: SecurityModelRef = { provider: model.provider, modelId: model.id };
		if (input.thinkingLevel !== undefined) modelRef.thinkingLevel = input.thinkingLevel;
		const plan = await createSecurityScanPlan(
			{
				cwd: this.#host.cwd,

View on GitHub (pinned to 9690622007)

Solutions

Set security.enabled to true in your opencode/omp settings (project or global config) and retry preflight.
Confirm the correct settings scope is being read — the value may be disabled at a higher-precedence scope than the one you edited.
If security scanning is intentionally off in this environment, route the work to an environment where it is enabled.

Example fix

// before: opencode.json
{ }
// after
{ "security": { "enabled": true } }

Defensive patterns

Strategy: validation

Validate before calling

if (!settings.get("security.enabled")) {
  throw new Error("enable security.enabled before planning a scan");
}

Try / catch

try {
  await coordinator.preflight(input);
} catch (err) {
  if (err instanceof Error && err.message.startsWith("Security is disabled")) {
    // surface a config hint to the user: set security.enabled: true
  } else throw err;
}

Prevention

Check settings.get("security.enabled") once at automation startup before any security calls.
Document the required config in your project setup so fresh clones include it.
Beware scope precedence: project settings can override global security.enabled.

When it happens

Trigger: Calling preflight() (directly or via a security-scan command/tool) while settings.get("security.enabled") returns false — i.e. the setting is absent from config and defaults to disabled, or is explicitly false.

Common situations: Fresh install where security.enabled was never configured; config file that defines other security keys but not security.enabled; running the scan from a project whose local settings override a globally enabled default.

Related errors

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/4a0b3d3fbc84f78a. Report an issue: GitHub.