Florian BRUNIAUX
|
46c5862c4e
|
fix(docs): critical factual corrections v3.6.1
Major audit correcting misleading documentation about Claude Code behavior:
### Fixed
- `--add-dir`: permissions (not context loading)
- `excludePatterns` → `permissions.deny` (never existed)
- `.claudeignore` removed (not an official feature)
- "selective loading" myth → lazy loading reality
- Invented CLI flags (`--think`, `--headless`, `--learn`) → prompt keywords
- `@` file reference: "loads automatically" → "reads on-demand"
### Added
- Session Search Tool (`cs`) - zero-dep bash script for finding sessions
- Security section: Known limitations of permissions.deny
15 files modified, 516 insertions, 200 deletions
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2026-01-15 09:16:53 +01:00 |
|
Florian BRUNIAUX
|
34b2ca7200
|
feat(security): add security hardening guide and hooks v3.6.0
- Add guide/security-hardening.md (~10K) covering:
- MCP vetting workflow with CVE-2025-53109/53110, 54135, 54136
- Prompt injection evasion techniques (Unicode, ANSI, null bytes)
- Secret detection tool comparison (Gitleaks, TruffleHog, GitGuardian)
- Incident response procedures
- Add 3 new security hooks:
- unicode-injection-scanner.sh: zero-width, RTL, ANSI escape detection
- repo-integrity-scanner.sh: scan README/package.json for injection
- mcp-config-integrity.sh: verify MCP config hash
- Update existing hooks:
- prompt-injection-detector.sh: +ANSI, +null bytes, +nested cmd
- output-secrets-scanner.sh: +env leakage, +generic tokens
- Update cross-references in ultimate-guide.md (§7.4, §8.6)
- Move MCP Security Hardening to Done in IDEAS.md
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
|
2026-01-15 07:39:53 +01:00 |
|