[Bug][aup] SSH key check and git host auth test wrongly blocked during routine developer setup (req_011CcUE5fyE9yUvTdjxJN75m)

Triage: kind aup · domain general · severity session-halted (blocked authorized work) · reproducible: yes — server-side via the Request ID(s) below

Type: AUP / Usage-Policy block (false positive) · Work domain (heuristic): general

Why this is a false positive

The blocked session consisted entirely of diagnostic shell commands to inspect locally stored SSH keys and verify authentication to a version control hosting service — routine developer environment setup work with no offensive or policy-violating intent. The commands (ls ~/.ssh/, ssh -T, git config) are standard read-only diagnostics any developer runs when troubleshooting a broken push/pull workflow, and none of them exfiltrate credentials, target third parties, or perform any action beyond confirming whether an existing key is recognized by the user's own account. The safety block appears to have triggered on the presence of SSH and authentication terminology in a shell context rather than on any actual policy violation.

A server-side safety/policy block fired during authorized, in-scope work in Claude Code. Filing as a false positive. Recurred 1× across 1 session(s); first seen 2026-06-27T18:19:56.120Z.

Request IDs (lookup-able server-side)

• req_011CcUE5fyE9yUvTdjxJN75m (2026-06-27T18:19:56.120Z)

In-scope justification

False positive — in-scope, authorized security work; not out of scope. Filed automatically by claudit.

Block message

API Error: Claude Code is unable to respond to this request, which appears to violate our Usage Policy (https://www.anthropic.com/legal/aup). Please double press esc to edit your last message or start a new session for Claude Code to assist with a different task.

Request ID: req_011CcUE5fyE9yUvTdjxJN75m

Environment: Claude Code, Linux. · Work domain: general

---
_{🔎 Filed automatically by ClAudit v2.0.89 — a FOSS tool for reporting false-positive Claude Code blocks.}