Oversized HTML Reports in Claude Code Desktop Preview Could Expose Local SSH and Cloud Credentials

·6 views

Noma Security disclosed a vulnerability in the HTML preview pane of the Claude Code Desktop app that could let a script in a crafted file read local secrets. Files under 256KB were rendered with a restrictive Content Security Policy, but larger files were loaded via file:// URLs without those protections. The flaw could expose SSH keys, cloud and GitHub tokens, and other credentials, and Anthropic rated it CVSS 8.7 (High). A fix reached users through auto-update in Claude Desktop version 1.30096.1, and no in-the-wild exploitation has been reported.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Coordinating Multiple Shuttles in Four-Way AS/RS: Routing, Traffic Control and Deadlock Avoidance

A four-way shuttle automated storage and retrieval system can move pallets both horizontally and vertically within a high-density rack, but adding more shuttles does not raise throughput proportionally. Multi-shuttle scheduling assigns storage and retrieval tasks across the fleet while coordinating routes, priorities and shared resources to keep the system stable. Shuttles competing for aisles, intersections, transfer points and lifts can cause waiting, repeated replanning and lost productive time. Uneven task allocation can leave vehicles idle, and resource conflicts can produce deadlocks even when physical collisions are avoided. Effective control therefore has to coordinate the whole material-handling chain, including lifts and conveyors, rather than optimize shuttle movement alone.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Keeping Helm Chart Values Consistent Across Staging and Production

A deployment can pass in staging yet fail in production with one replica, debug logging, and a wrong ingress host, often because the values were assembled differently rather than because of a chart bug. Helm merges values from the chart's defaults, parent chart files, and override files in a defined order, with maps merged key by key while lists are replaced entirely. Setting a key to null in an override removes the default, and helm get values and helm get values --all help reveal what each release actually uses. Common mistakes include duplicating the full values file per environment, embedding environment checks in templates, relying on long CI --set chains, and mishandling type coercion or secrets. The recommended approach keeps values.yaml as production-shaped defaults and limits each environment file to its differences, so templates remain identical across environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Changelog generator missed deleted files because it ignored git's D status

A developer building a Git changelog API found that a contributor's deletion of an entire module between two releases went unreported, with the tool producing no warning. The cause was that the generator only rendered added and modified files, dropping the deletion status that git diff reports. The fix treated deletions as first-class changes and gave them more prominent wording than additions. The developer also found that commit messages can be misleading, so the diff is now treated as the authoritative source and messages are demoted to a footnote. The author contrasts this with convention-based tools like semantic-release and changesets, which depend on disciplined commit formats.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

FIDO2 Account Recovery Emerges as Weak Point in Passwordless Rollouts

Hardware-bound FIDO2 authenticators resist phishing, but their design makes account recovery difficult when a user loses the device. Organisations adopting passkeys typically build a recovery path, and that path is often weaker than the password it replaced. Documented attacks on MFA deployments tend to bypass the cryptographic factor entirely, instead persuading support staff to reset credentials using victims' personal details. The article recommends treating recovery as a strict authentication process, verifying backup authenticators at enrolment, notifying owners through independent channels, and failing closed when verification is incomplete. It also notes that no widely adopted standard yet matches the assurance of the FIDO2 login process, so residual risk remains.

0 comments Read more at DEV Community