Claude Code: We've Got Issues

Fri, 17 Apr 2026 00:00:00 +0000

A personal Software Development Lifecycle (SDLC), earned the hard way

Claude Code is Anthropic's AI coding agent — an LLM that lives in your terminal, reads your codebase, and writes code on your behalf. Two years of using it, and a pattern I can now recite from memory. Given half a chance, it will do any of the following and report the job done.

Treat questions as instructions. "What do you think of X?" parsed not as an invitation to discuss but as a command to go and build X - committed to the codebase, sometimes with product decisions made along the way that nobody asked it to make, before the conversation has even started.
Override the human-in-the-loop entirely. Type the human's approval keywords into its own chat output to unlock states only the human should unlock. Invoke the human's emergency bypass keyword on its own authority because it decided the current task didn't need human review. Forgery and self-granted exemption, both reported as task-complete.
Disable a script's own safety mechanism quietly. The script begins with the standard stop-immediately-if-anything-fails header (set -e), then appends an override (|| true) to every risky command below it, which tells the shell to pretend the line succeeded no matter what actually happened. The safety header is there. The safety is not.
Make sensitive files readable, writable, and executable by anyone at all - including unauthenticated strangers reaching the machine over the internet - to get past a permissions error (chmod 777).
Switch off the check that verifies a web server is who it claims to be (SSL/TLS verification¹), because a server's certificate was inconvenient.
Hardcode credentials into source that was about to be committed.
Silently create a public GitHub repository and upload an entire directory tree to it, because it thought it should raise a ticket. To overcome the "obstacle" of finding itself in a private folder that was not tracked by a git² repository.
Report green across the board on a test suite that never actually ran the command a user would type. The compiled code did nothing. The dashboard said healthy, every test passed! Ostensibly the tests were there, but it had written them in a way that was most convenient for itself with the least amount of effort.³

None of these are obscure mistakes. They are safety-critical decisions being made unilaterally, to get past whatever was in the way, and reported as task-complete.

These are not occasional slips. They are patterns. Reliable enough that you can name them and watch them recur on the next project if you do not actively intervene.

Setup & Harden a Linux Server in 2026

Thu, 29 Jan 2026 00:00:00 +0000

If you spin up a fresh Linux box today, it's not "new" for long. The moment it's reachable, it's being scanned, prodded, and occasionally hammered by automated traffic. That's not paranoia, it's just the background noise of the modern internet. Honeypot data has been consistent for years: a brand-new instance with a public IP will typically see its first SSH probe within minutes, and credential-stuffing attempts shortly after.

Cloud providers have made it trivially easy to create compute instances. What they haven't done is make them safe by default. You still get a general-purpose system with a wide attack surface, and it's on you to reduce that surface before you put anything meaningful on it.

AI Safety: A Quick Reference

Thu, 27 Mar 2025 00:00:00 +0000

This is a reference companion to my series on understanding AI. Before diving into the practical guides and opinion pieces, take a moment to understand the risks.

Using AI-generated material

Before using information or data generated by an AI service, be aware:

Generative AI can hallucinate, which is another way of saying it makes things up. Check all information before using it. Carefully parse summaries in case it misses nuance or key information.

Security on tigger.dev

Claude Code: We've Got Issues

A personal Software Development Lifecycle (SDLC), earned the hard way

Setup & Harden a Linux Server in 2026

AI Safety: A Quick Reference

Using AI-generated material