Repository navigation
Tags
Tags
Schedule tests turn off every check the policy knows A check that fails where the tests run (admin-rights as root on Linux CI, os-protections on a CI Mac) made the machine report daily under report.fail_interval. The list is read from policy.Checks. gofmt. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
Threat model, security policy, full-scan -verify, new release key - docs/threat-model.md and SECURITY.md (private reporting, US$100 bounty) - full-scan -verify asks each provider whether the tokens found still work - a token caught as a variable name is no longer reported as the name - new ed25519 release key kept in touchenv; PreviousKey trusted for one release; sign-macos-release.sh builds every binary and signs SHA256SUMS locally; the workflow uses a maintainer-signed SHA256SUMS when the draft has one - macOS: updates must carry the running copy's Developer ID team; install.sh checks the Developer ID before running the binary Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
Cloud CLIs' sign-in caches are information, with how to sign out Azure CLI's token cache and gcloud's credential store and application default credentials are kept in plain text by design and revoked by signing out. The secrets check now lists them for information, with the sign-out advice in its summary, instead of warning. Policy: checks.secrets.cli_sign_ins_info (default true). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
Cloud CLIs' sign-in caches are information, with how to sign out Azure CLI's token cache and gcloud's credential store and application default credentials are kept in plain text by design and revoked by signing out. The secrets check now lists them for information, with the sign-out advice in its summary, instead of warning. Policy: checks.secrets.cli_sign_ins_info (default true). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
guard command reads the command as the shell does The PreToolUse hook matched words anywhere in the command line, so a commit message mentioning "touchenv get" was refused. It now splits the line into simple commands at unquoted ; & | ( ) and line breaks (and inside $(...) and backquotes), takes each one's words with quotes removed, and judges only the command word and its arguments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
Own fix for each credential store; guard suggested on any Claude Code… … machine; fewer false alarms in chats - The secrets fix gives each credential store its own advice (az logout for Azure CLI's token cache, gh auth login for a GitHub CLI token, a credential helper for git and Docker…) instead of 'move it to the keychain'; the general advice stays when other secrets are found too. - The summary suggests bordercheck guard install wherever Claude Code is used and the hooks are not all on, secrets found or not. - Chat scan: a password that is code (another variable, a field, a query string) and a URL whose host is a pattern or an example are not secrets. bordercheck chats lists every line a repeated secret is on. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
An update sets up what the new version adds at once After bordercheck update, plain bordercheck was still missing until the next hourly run, because only that run created the link. The version being replaced now runs the new one's setup once, and update does the same set-up itself when there is nothing new to install. Co-Authored-By: Claude Fable 5.2 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Q1tC8pHZuLCqDE9MGuX4ai
PreviousNext