Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
nicedreamzapp/claude-code-local
main @ 2b024f1
2
Fixes
0
CVEs
CRITICAL
Peak severity
Highlights
Auth Bypass: 1 prior fix. Scrutinize any change in this area.
launchers: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The local orchestrator API was exposed without authentication and was not strictly bound to localhost. This could allow unauthorized network actors to access critical endpoints such as status checks and task runners to execute arbitrary tool commands and AppleScripts.
Information Disclosure: Launcher scripts originally permitted non-essential external network traffic to Anthropic servers for telemetry, autoinstallers, and autoupdaters. This default behavior leaks local execution data and environment details in supposed offline configurations.