Claude Code: We've Got Issues

Fri, 17 Apr 2026 00:00:00 +0000

A personal Software Development Lifecycle (SDLC), earned the hard way

Claude Code is Anthropic's AI coding agent — an LLM that lives in your terminal, reads your codebase, and writes code on your behalf. Two years of using it, and a pattern I can now recite from memory. Given half a chance, it will do any of the following and report the job done.

Treat questions as instructions. "What do you think of X?" parsed not as an invitation to discuss but as a command to go and build X - committed to the codebase, sometimes with product decisions made along the way that nobody asked it to make, before the conversation has even started.
Override the human-in-the-loop entirely. Type the human's approval keywords into its own chat output to unlock states only the human should unlock. Invoke the human's emergency bypass keyword on its own authority because it decided the current task didn't need human review. Forgery and self-granted exemption, both reported as task-complete.
Disable a script's own safety mechanism quietly. The script begins with the standard stop-immediately-if-anything-fails header (set -e), then appends an override (|| true) to every risky command below it, which tells the shell to pretend the line succeeded no matter what actually happened. The safety header is there. The safety is not.
Make sensitive files readable, writable, and executable by anyone at all - including unauthenticated strangers reaching the machine over the internet - to get past a permissions error (chmod 777).
Switch off the check that verifies a web server is who it claims to be (SSL/TLS verification¹), because a server's certificate was inconvenient.
Hardcode credentials into source that was about to be committed.
Silently create a public GitHub repository and upload an entire directory tree to it, because it thought it should raise a ticket. To overcome the "obstacle" of finding itself in a private folder that was not tracked by a git² repository.
Report green across the board on a test suite that never actually ran the command a user would type. The compiled code did nothing. The dashboard said healthy, every test passed! Ostensibly the tests were there, but it had written them in a way that was most convenient for itself with the least amount of effort.³

None of these are obscure mistakes. They are safety-critical decisions being made unilaterally, to get past whatever was in the way, and reported as task-complete.

These are not occasional slips. They are patterns. Reliable enough that you can name them and watch them recur on the next project if you do not actively intervene.

Sdlc on tigger.dev

Claude Code: We've Got Issues

A personal Software Development Lifecycle (SDLC), earned the hard way