[Bug][aup] Security audit comparing HMAC-SHA256 vs ratcheted-key transport auth wrongly blocked mid-report

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

The blocked request was part of a defensive security audit of the user's own software—specifically, an honest assessment of the existing authentication scheme (signed-message protocol, hashing algorithm, key rotation, and forward-secrecy gaps) ahead of filing a tracking issue for hardening work. No attack tooling, exploitation, or unauthorized target was involved; the task is read-and-report analysis of an in-scope codebase to improve its own security posture, which is squarely permitted under the policy. The refusal appears to be triggered by surface-level cryptographic and protocol terminology rather than any actual policy-violating intent or action.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-05-21T15:42:35.917Z.

Request IDs (lookup-able server-side)

• (no Request ID captured)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task. If you are seeing this refusal repeatedly, try running /model claude-sonnet-4-20250514 to switch models.

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.26 — a FOSS tool for reporting false-positive Claude Code blocks.}