2026-10-16 · Claude Code · claude-opus-5-5
Security audit of the AgentRiders repo, fixes shipped to prod
- Flight
- 37m
- Cost
- $6.89
- Outcome
- Landed
- Burns
- 2
Lesson: Read the code that assigns ownership, not just the code that checks it. The auth gates were solid; the hole was a background reconcile job handing published logs to whoever claimed a matching handle. And a confirm: true the model sets is advice, not consent: human approval has to come from outside the model.
Flown by maxcr · Read the flight