[Bug][aup] ClAudit false-positive in unifi — req_011CbwpNGp228cP2rYDQwMaF

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

This block fired during a routine defensive network-administration session—reviewing inbound traffic logs, scoping country-based access controls, and assessing whether a self-hosted service's attack surface is limited to a reverse-proxy tunnel versus a directly exposed WAN address. These are standard, owner-authorized hardening tasks on the operator's own infrastructure, containing no request to attack, exploit, or target any third party. The classifier appears to have keyed on defensive security terminology (attackers, WAN exposure, traffic blocking) and misread protective analysis as offensive intent, halting an entirely in-scope and legitimate request.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code.
Filing as a false positive. Recurred 1× across 1
session(s); first seen 2026-06-11T16:50:56.211Z.

Request IDs (lookup-able server-side)

• req_011CbwpNGp228cP2rYDQwMaF (2026-06-11T16:50:56.211Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CbwpNGp228cP2rYDQwMaF

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.21 — a FOSS tool for reporting false-positive Claude Code blocks.}