I bypassed my own Claude Code deny-list in eight ways. Only an allow-list held.
This story is from 2026-09-11. It is preserved in the archive; the latest stories are on the live feed.
In April 2026 a coding agent at PocketOS hit a credential mismatch in staging, found an infrastructure token in an unrelated file, and deleted the production database and its volume backups in one API call. Thirty hours down. Every post-mortem named the same causes: a token within reach, no gate on…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-11 15:47 · DEV Community — AI
I bypassed my own Claude Code deny-list in eight ways. Only an allow-list held.