[Bug] Fable 5 safeguard incorrectly flags legitimate defensive code review of credential-handling code

Summary

The built-in /security-review command triggers Fable 5's cyber safeguard when
run on my own open-source browser extension (a Bitwarden-style password
manager), force-switching the session to Opus 4.8.

What I was doing

Running /security-review for a defensive audit of my own code: crypto layer,
storage, content-script isolation. No exploit development, no offensive tooling
requested.

What happened

The safeguard flagged the vulnerability-identification sub-task spawned by
/security-review and switched the session to Opus 4.8:

Fable 5's safeguards flagged this message. The safeguards are intentionally broad right now and may flag safe and routine coding, cybersecurity, or biology work. [...] Switched to Opus 4.8.

Why this is a false positive

This is the exact use case /security-review ships for — reviewing one's own
code for vulnerabilities before release. The trigger appears to be vocabulary
inherent to the domain (credentials, vulnerability, injection) rather than
intent: any password-manager codebase saturates the session context with these
terms, so the flag fires on essentially every review run.

Impact

Fable 5 is effectively unusable for defensive security review of
credential-handling code — the workload that arguably benefits most from the
strongest model. A first full-project review cannot complete on Fable at all.

Suggestion

Weigh session context (a first-party repo, the built-in /security-review
workflow) over keyword density, or let /security-review declare a defensive
context the classifier can take into account.

Environment

• Platform: darwin
• Terminal: tmux
• Version: 2.1.217
• Model: claude-fable-5 (fallback target: claude-opus-4-8)
• Feedback ID: 711f2e5b-1136-4256-972b-e671f0c2d264