Claude Code Config Keys Can Silently Fail If Placed in the Wrong Settings File

·1 views

A developer discovered that certain Claude Code configuration keys, including autoMode, have no effect when placed in a project-level .claude/settings.json file, producing no errors or warnings. Claude Code's settings reference defines 223 configuration keys, of which 71 are scope-restricted, meaning they only work from specific files such as the user-level ~/.claude/settings.json or managed settings. The silent failure made debugging difficult, as valid JSON and startup logs gave no indication that the keys were being ignored. The developer found their own manually maintained list of scoped keys was missing an entire category — 23 'user or managed' keys, including autoMode. In response, they built an open-source CLI checker, ccheck, that warns users when a config key is placed in a file where it has no effect.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Why AI Data Agents Need More Than RBAC to Prevent Sensitive Data Leaks

Role-based access control (RBAC) remains essential for enterprise data security, but AI analytics agents introduce a new vulnerability known as the inference gap, where restricted information can be derived from permitted data. For example, a user denied access to employee salary figures could still calculate average compensation by combining authorized fields like department total cost and headcount. Traditional authorization models govern access to database objects but do not account for what an AI agent can logically infer from those objects. To address this, experts recommend semantic authorization, where policies are defined at the business-concept level and evaluated before SQL is generated, not just at query execution. This approach ensures that authorization constrains the reasoning context of an AI agent early in the pipeline, closing the gap between what a user can access and what they are permitted to learn.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Silent 74-Hour Queue Drift: One Field, Two Interpretations, Zero Alerts

Over twelve days in late August and early September 2026, an automated Bluesky posting system silently drifted 74 hours behind schedule without triggering any errors or missed posts. The root cause was a single timestamp field, plannedFor, being interpreted differently by two parts of the same system: the executor treated it as a 'not before' lower bound, while the planner treated it as a fixed calendar slot. Because the executor reliably posted five times daily, the queue kept draining, but each weekly restock added new rows dated against a calendar the executor ignores, steadily growing the backlog from 6 to 16 stale rows. Git history confirmed the drift had been accumulating since at least August 25, with the oldest unposted row reaching 73–74 hours past its label by September 4–6. No delivery failures occurred throughout, making the issue invisible to standard monitoring and only detectable by directly comparing timestamp labels to actual post times.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Google Completes Third Spam Update of 2026, Affecting Search Rankings Globally

Google rolled out its August 2026 spam update between August 18 and August 21, marking the third such update this year following earlier releases in March and June. The update is a global, multilingual adjustment to Google's spam detection systems, with no new spam policies introduced alongside it. Third-party data from SE Ranking, cited by Search Engine Land, showed an 82% rise in top-10 URLs dropping out of the top 100 during the update window, highlighting significant ranking volatility. Google clarified that ranking changes during a spam update do not automatically pinpoint a specific page or tactic as non-compliant. Website owners are advised to methodically review affected content against existing spam policies rather than making rushed, sweeping changes to their sites.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

DEV Community Spam Comment Traced to Affiliate Marketing Scheme via Fake Domain

A developer investigated a spam comment posted on their DEV Community article in September 2025, which contained a TinyURL linking to a throwaway domain called zenviapro.store. Using curl commands to trace redirects without clicking, they found the link ultimately led to LoopCV, a legitimate job-application automation SaaS, with an affiliate tracking code appended. The intermediary domain had no real website and consisted of a single Express.js route that redirected all traffic regardless of query parameters. The account behind the comment used a faker.js-generated name and a 19th-century wombat engraving as its profile image. The investigator estimated the operation only needs three paying referrals per year to break even, concluding that the low cost makes such spam economically self-sustaining.

0 comments Read more at DEV Community