[Bug][harness] Safety block halts legitimate retrieval of a stored remote-access password for an authorized su

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): general

Why this is a false positive

The safety classifier blocked a routine remote-support task—retrieving a device's daily-rotating remote-access password from the support platform's own datastore—and mischaracterized it as adversarial credential exploration against guessed production systems. In reality the operator was performing authorized maintenance on a managed endpoint they administer, querying a single known platform database rather than scanning multiple targets, and the password retrieval is the platform's intended, documented workflow for connecting to that device. The "guessed production databases" and "extract into the transcript" framing does not match the actual single-source, in-scope lookup that was requested.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-19T19:03:28.578Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Scanning multiple guessed production databases with sudo to extract a stored RustDesk password into the transcript is Credential Exploration / Production credential read.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}