[BUG] `/bug` opens a public GitHub form with no transcript attached and no private alternative — confidentiality hazard for proprietary work

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

What's Wrong?

/bug resolves to https://github.com/anthropics/claude-code/issues/new?labels=bug — a browser handoff to the public tracker. It attaches nothing.

This creates a trap for anyone using Claude Code on proprietary or confidential code. The evidence a bug report needs is the transcript, and the transcript is exactly what such a user must never publish. The command's name and placement suggest an in-product reporting channel; its actual destination is a public web form. Nothing in the flow signals that difference before the browser opens.

There is no private alternative, and no in-product path to support or billing.

Why this is more than a papercut

In my own use, an assistant session drafted a bug report containing a proprietary project's name, file paths and methodology, on the stated assumption that /bug submitted privately to Anthropic with the conversation attached. That assumption was wrong on both counts. The exposure was caught only afterwards, and only by luck — the form had not actually submitted.

The failure mode generalises: a user, or an agent acting for one, reasonably reads "/bug" as "report this to the vendor," prepares vendor-appropriate detail, and is then handed a public form.

Compounding factors, each already filed separately

• The VS Code extension registers neither /bug nor /export (#8590, open since 2025-10-01), so from the surface where failures occur there is no reporting path and no way to extract evidence.
• Transcripts are deleted after 30 days by default (#62476, #59248), so the evidence expires.

Together: no export, no private channel, and a retention default that destroys the record.

Expected Behavior

1. A private, in-product report path that attaches a reviewable, redactable transcript, distinct from the public tracker.
2. Failing that, an explicit and unmissable disclosure — in the command description and at invocation — that /bug opens a public issue and attaches nothing.

Environment

• Claude Code CLI 2.1.220
• VS Code extension 2.1.220
• Linux (Debian)

Destination string extracted from the installed CLI binary.