[Bug][aup] Adding right-click disable and text-selection hardening to a web app login page wrongly blocked (req_011CcKTwdsbNSzCwzX2fduHw)

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): defensive-hardening

Why this is a false positive

This request was part of routine front-end UI development on a login page—styling a QR-code login flow, adding a decorative WebGL shader background, and applying standard client-side hardening (disabling text selection and the right-click context menu via CSS/JS). These are common, well-documented web patterns with no malicious capability, yet the request was blocked as a policy violation, likely because terms like "hardening" and "login" pattern-matched to security-evasion intent. The block is a false positive: nothing in the task involves unauthorized access, credential theft, or evading security controls—it is ordinary defensive UI work on the developer's own application.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-23T03:16:29.942Z.

Request IDs (lookup-able server-side)

• req_011CcKTwdsbNSzCwzX2fduHw (2026-06-23T03:16:29.942Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcKTwdsbNSzCwzX2fduHw

Environment: Claude Code, Linux. · Work domain: defensive-hardening

---
_{🔎 Filed automatically by ClAudit v2.0.12 — a FOSS tool for reporting false-positive Claude Code blocks.}