security
- One space in a path, and Hermes blocked echo hi
An unquoted hook path met a home directory with a space, and my fail-closed guard blocked every Hermes tool call. A custom home also exposed the rules.
- My unit tests never typed `; echo`
Fixing a guard's false positives exposed a hole, and the tighter rule passed every unit case. Then four agents failed one near miss: the command had a tail.
- My sandbox profile had never run as shipped
My opt-in Claude Code sandbox profile had never been run. Its first run showed three ways it would break Maven and Gradle builds; the fix had a price.
- My guard read the tool's name, never its arguments
Loosening the Ghidra MCP rules for my coding agents turned up a hole: the guard judged tools by name, so it never checked which path an import was given.
- My guard blocked bash -c. Models write bash -lc.
A regex guard for auto-approved coding agents denied bash -c 'rm -rf build' and allowed bash -lc. The end-to-end case had used the first spelling.
- An exception in one layer deleted a block in another
Letting my agents delete extraction folders made a config generator drop a deny glob. That glob had been the only thing stopping $(echo rm) -rf in one agent.
- The guard rails that said no
A deploy script that aborted, a permission check that refused firmware, a password with one copy, and a grep that said yes when it should have failed.
- Deleting a GitLab project gives it a new name
DELETE /projects/:id answered 202 Accepted. Five seconds later the project was still there, renamed. Then the local branch nobody pushed yet.
- Hardening the box you're logged in through
Earlier that night I killed the poller that would have proved me wrong. Under twenty minutes later, the changes went in with their tests written first.
- Transmission is a remote-code-execution box by default
Transmission runs a script of the RPC caller's choosing when a torrent finishes. Seccomp can't block that exec; a systemd sandbox can make it worthless.