[Bug][harness] SSH read of source/config files to debug a user-reported bug wrongly blocked as production acce

Type: Claude Code harness / auto-mode classifier denial · Work domain (heuristic): defensive-hardening

Why this is a false positive

The block is a false positive: the operator was actively debugging a user-reported defect (server-side 500 errors and a client-side database exception) and needed to read application source and configuration on the host where that code runs in order to locate the fault. Reading those files is the diagnostic step required to reproduce and fix the reported bug, not an unsanctioned production action — the work is squarely within an authorized defensive-hardening scope. The earlier declined SSH was for a different, unrelated purpose and does not indicate a standing objection to read access for this debugging task.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-12T07:06:59.981Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

Reading source/config files inside the production wrapper host via SSH is a Production Read requiring explicit user approval naming the prod target; the user only reported a bug and earlier rejected an SSH into this same host.

Environment: Claude Code, Linux. · Work domain: defensive-hardening

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}