[Bug] Anthropic API Error: Overly broad safeguard blocking legitimate security code reviews

Bug Description
False-positive safeguard block in Claude Code / Fable 5

Two consecutive, legitimate software-engineering requests were blocked by Fable 5’s safeguards:

• req_011CcxKSpSVH8p5ikD2R79P6
• req_011CcxLB58hhgS4X1558VUKp

The requests concerned a read-only security and architecture review of locally developed onboarding code. The reviewed topics included:

• verifying email credentials before storing them;
• preventing credentials from appearing in logs, chat context, or error messages;
• TLS certificate validation and protection against SSRF/DNS rebinding;
• read-only IMAP, SMTP authentication, and CalDAV connectivity checks;
• secure credential reuse and account-specific secret names;
• identifying ordinary P0/P1/P2 software findings.

The prompt explicitly prohibited file modifications, network access, cloud mutations, deployment, and secret disclosure. It requested only static analysis of a local Git diff and a structured code-review report.

This was defensive software-security work intended to reduce credential exposure and prevent unsafe network access. It did not request malware, exploitation, credential theft, unauthorized access, evasion, or any other prohibited activity.

The false positive interrupted an ongoing development workflow and forced us to move normal defensive reviews to a different model and separate sessions. Please review both request IDs and adjust the safeguard classification so that read-only defensive code reviews of authentication, credential handling, TLS, SSRF protection, and secret lifecycle management are not blocked merely because they contain security-related terminology.

It would also help if the error identified which portion or category caused the block, so that legitimate prompts could be narrowed without repeated trial and error.

Environment Info

• Platform: win32
• Terminal: windows-terminal
• Version: 2.1.205
• Feedback ID: f2fa4cae-523c-4036-adce-fff1b7e88bc0

Errors

[{"error":"TelemetrySafeError: VirtualMessageList: itemKeys/messages length desync (keys=500 messages=499 range=[473,500))\n    at xn_ (B:/~BUN/root/src/entrypoints/cli.js:9874:8140)\n    at GJd (B:/~BUN/root/src/entrypoints/cli.js:9874:1103)\n    at yi (B:/~BUN/root/src/entrypoints/cli.js:592:21211)\n    at yp (B:/~BUN/root/src/entrypoints/cli.js:592:39996)\n    at S$ (B:/~BUN/root/src/entrypoints/cli.js:592:50807)\n    at Wd (B:/~BUN/root/src/entrypoints/cli.js:592:87884)\n    at TJ (B:/~BUN/root/src/entrypoints/cli.js:592:86845)\n    at AJ (B:/~BUN/root/src/entrypoints/cli.js:592:86667)\n    at NP (B:/~BUN/root/src/entrypoints/cli.js:592:82993)\n    at sr (B:/~BUN/root/src/entrypoints/cli.js:592:6597)","timestamp":"2026-07-09T13:32:30.625Z"}]