Security Good First Issues

Explora issues de código abierto agrupados bajo Security. Si la materia aparece en los metadatos con nombres más antiguos, también se tienen en cuenta.

Security

Señales del conjunto

Dificultad anotada media: 4.0/5 en 3,320 issues.
9% de 3,320 estimaciones de tiempo son de un día o menos.

Abierto Todos

process-gap(tdd): security-invariant ACs require mutation verification — a test that still passes when the guard is removed does not test the guard Abierto

BOHICA-LABS/vsdd-factory#676 · 2 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
process-gap(implementer+orchestrator): a code fix that changes a documented call-contract sweeps the changed line + inline comment but not the function godoc header nor the behavioral-contract specs documenting that call — two extra adversarial passes to close Abierto

BOHICA-LABS/vsdd-factory#708 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
bug(hooks): verify-git-push fails open — lease substring disables the force guard, and any flag before the remote defeats the protected-branch guard Abierto

BOHICA-LABS/vsdd-factory#790 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
bug(tooling-guards): destructive-command-guard matches command patterns inside a write payload — a document that merely mentions 'git clean' cannot be written via heredoc Abierto

BOHICA-LABS/vsdd-factory#793 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
bug(destructive-command-guard): sot_delete arm tests deletion and filename independently — blocks read-only commands, and blocked the filing of this report Abierto

BOHICA-LABS/vsdd-factory#812 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
bug(adversary): agent declares read-only tools (Read/Grep/Glob) but can write files, and cannot execute — the reviewer can modify its subject and cannot verify it Abierto

BOHICA-LABS/vsdd-factory#825 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
bug(dispatcher): fuel exhaustion is indistinguishable from successful validation — oversized artifacts silently skip structural gates Abierto

BOHICA-LABS/vsdd-factory#827 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
safety(intake): issue bodies as artifact input put untrusted text upstream of the adversarial cascade Abierto

BOHICA-LABS/vsdd-factory#835 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Add a SECURITY.md with a vulnerability disclosure policy Abierto

bobluppes/graaf#321 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Add sanitizer (ASan/UBSan/TSan) and fuzz testing to CI Abierto

bobluppes/graaf#326 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Add identity provider (SSO) support Abierto

enhancement priority: low

bobbylite/hermes-admin-dashboard#3 · 0 comentarios · 1 reacción · 2 asignados · Indexado el 14/9/2026
Wire SPIFFE/SPIRE workload identity Abierto

enhancement

bobbylite/service-template#1 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Add auth/authorization middleware Abierto

enhancement

bobbylite/service-template#2 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Incorrect "impossible" judgment led to full disablement of production safety guards Abierto

area:model area:permissions bug platform:vscode platform:windows

anthropics/claude-code#92180 · 3 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] Claude cloud sessions cannot git push to any repository Abierto

area:claude-code-web bug has repro platform:web

anthropics/claude-code#92188 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] Browser pane per-action permission prompts never persist for non-localhost origins Abierto

area:desktop area:permissions bug platform:windows

anthropics/claude-code#92195 · 1 comentario · 1 reacción · 0 asignados · Indexado el 14/9/2026
Claude Design first-party MCP always 403s: transport never attaches design-scoped token, `claude mcp login` OAuth flow is dead, and the error message suggests a nonexistent `/design-login` command Abierto

area:auth area:mcp bug platform:macos

anthropics/claude-code#92215 · 2 comentarios · 1 reacción · 0 asignados · Indexado el 14/9/2026
[Bug] Overly strict content policy blocking legitimate rental application PDF generation Abierto

area:model bug platform:linux

anthropics/claude-code#92218 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Permission dialog presents machine-composed commands as unreadable monochrome text Abierto

area:permissions duplicate platform:vscode

anthropics/claude-code#92243 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Browser pane tool fails on all read/screenshot calls with "Policy check temporarily unavailable" Abierto

area:desktop area:tools bug platform:windows

anthropics/claude-code#92248 · 2 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
CLAUDE_CONFIG_DIR set to the default path ($HOME/.claude) selects a different Keychain credential entry than leaving it unset, with no diagnosis Abierto

area:auth bug has repro platform:macos

anthropics/claude-code#92252 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[FEATURE] Agent(agent_type) allowlist in tools has no effect inside a nested subagent definition Abierto

area:agents area:permissions enhancement

anthropics/claude-code#92259 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[Bug] Anthropic API Error: Content flagged by safeguards on benign input Abierto

area:model bug platform:linux

anthropics/claude-code#92263 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[Bug] Model creates Jira tickets without explicit affirmative approval despite standing instructions Abierto

area:mcp area:model bug platform:intellij

anthropics/claude-code#92267 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Cowork sandbox network allowlist not affected by sandbox.enabled toggle in settings Abierto

area:cowork area:sandbox bug has repro platform:macos

anthropics/claude-code#92273 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] Regression since 2.1.259 on macOS: EACCES traversing /Library/Managed Preferences is treated as an unreadable managed policy and fails closed (works in 2.1.258) Abierto

area:core bug has repro platform:macos regression

anthropics/claude-code#92278 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Auto mode: let a classifier block fall back to a permission prompt instead of a hard deny Abierto

area:permissions enhancement

anthropics/claude-code#92279 · 1 comentario · 1 reacción · 0 asignados · Indexado el 14/9/2026
[BUG] GitHub Connector — "state: Field required" error blocks repo access Abierto

invalid

anthropics/claude-code#92284 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] Claude Code 2.1.261 crashes Abierto

area:sandbox bug platform:windows

anthropics/claude-code#92307 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] claude-security scan-changes reproducibly analyzes wrong diff content Abierto

area:plugins area:security bug has repro platform:windows

anthropics/claude-code#92317 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Restarting Claude Desktop on two machines registers each device twice; sessions then leave their project group and appear under "Other" on the other machine Abierto

area:desktop bug platform:windows

anthropics/claude-code#92318 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[Bug] Cybersecurity filter incorrectly flags password management system creation Abierto

area:model area:security bug platform:macos

anthropics/claude-code#92329 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Remote Control auto-start reports "re-login required" when the OAuth refresh simply hasn't landed yet (credential still renewable) Abierto

area:auth bug has repro platform:windows

anthropics/claude-code#92330 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
System-reminder wrapper for CLAUDE.md/MEMORY.md uses injection-shaped language ("OVERRIDE any default behavior... MUST follow exactly as written") Abierto

area:core area:security enhancement

anthropics/claude-code#92346 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] /permissions silently drops existing rules with lowercase tool names when adding a new rule Abierto

area:permissions bug data-loss

anthropics/claude-code#92350 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] UserPromptSubmit hook registered and valid but never invoked on real prompt submission (Git Bash CLI, Windows, v2.1.261) — possible regression of #17277 Abierto

area:hooks bug has repro platform:windows regression

anthropics/claude-code#92353 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Scheduled tasks: expose a per-task directory-access grant (parity with local-agent-mode's userSelectedFolders) Abierto

area:permissions area:routines area:security enhancement

anthropics/claude-code#92357 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
A non-string entry in sandbox.filesystem.denyRead/denyWrite silently disables permissions.deny and PreToolUse hooks (2.1.261) Abierto

area:permissions area:sandbox area:security bug has repro platform:wsl

anthropics/claude-code#92365 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] Session resumes and executes further tool calls after a hard trust-safety block, via background-task completion notification Abierto

area:core area:desktop area:security bug platform:macos

anthropics/claude-code#92369 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Feature request: opt-in local bridge so scheduled cloud agents (routines) can use local MCP servers Abierto

area:mcp area:routines enhancement

anthropics/claude-code#92372 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[Bug] False Positive Safety Flag on Git Workflow Discussion Abierto

area:model bug platform:macos

anthropics/claude-code#92375 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
CoworkVMService fails to configure SCM recovery actions — "Access is denied" on every start Abierto

area:cowork area:desktop duplicate platform:windows

anthropics/claude-code#92379 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
permissions.defaultMode is ignored by the desktop app - new sessions always start in manual mode Abierto

area:desktop area:permissions bug platform:windows

anthropics/claude-code#92394 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Permission-denied message shows a sub-command excerpt of the Bash command, not the full command or the matching deny rule Abierto

area:bash area:permissions bug has repro platform:macos

anthropics/claude-code#92398 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] Auto-mode classifier denials still append tool-substitution coaching ("use head instead of cat") on deliberate blocks — the refusal path already dropped it Abierto

area:permissions area:security bug has repro platform:wsl

anthropics/claude-code#92411 · 1 comentario · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Subagent edits in a git worktree outside the project root are treated as outside the project; additionalDirectories is the only workaround and it grants more than the worktree Abierto

area:agents area:permissions enhancement platform:macos

anthropics/claude-code#92417 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
Sandbox policy does not match settings.json: allowWrite glob refused, excludedCommands intermittently proxied Abierto

area:sandbox bug has repro platform:macos

anthropics/claude-code#92445 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
I appreciate the question, but I need to clarify: I'm Claude Code, an AI assistant designed to help with coding tasks. I'm not able to provide legal advice about reverse engineering or cybersecurity. However, I notice you haven't actually reported a bug i Abierto

area:model bug platform:linux

anthropics/claude-code#92483 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[BUG] git diff --unified=0 / -U0 triggers a permission prompt despite being read-only Abierto

area:bash area:permissions bug platform:vscode platform:windows

anthropics/claude-code#92484 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026
[Feature Request] Add automatic .env file protection to prevent accidental secret exposure in tool execution Abierto

area:sandbox area:security enhancement platform:macos

anthropics/claude-code#92487 · 0 comentarios · 0 reacciones · 0 asignados · Indexado el 14/9/2026

Mostrando los 100 más recientes

Esta página solo lista lo indexado más recientemente. El filtro avanzado tiene el inventario completo, acotado por lenguaje, dificultad y duración.

Abrir el filtro avanzado

Security Good First Issues

Señales del conjunto

Mostrando los 100 más recientes

Recibe los nuevos issues en tu correo