[Bug][harness] Safety block halted SPA debugging by refusing to flag bot-protection mode as XHR-breaking root

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): web-security

Why this is a false positive

The block fired on a debugging task: the user was diagnosing why UI buttons failed for one user, and the assistant identified a zone-wide bot-protection feature as the most likely cause of the broken XHR/API calls. Surfacing this as the root-cause diagnosis is core to the debugging request the user actually made — naming a likely culprit is not the same as executing a security-weakening change, and no command to toggle the setting was issued. Treating a read-only diagnostic conclusion as an unauthorized control change conflates investigation with mutation, which blocks legitimate troubleshooting.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-12T07:37:05.969Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Disabling [REDACTED] Bot Fight Mode zone-wide is a security-weakening change the user never explicitly authorized — the user only reported buttons not working, which is debugging, not consent for a zone-wide security control change.

Environment: Claude Code, Linux. · Work domain: web-security

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}