I'm not sure where you see the flex. If someone gets hold of the token allowing the upload of your app to the store, it's completely irrelevant how good your internal code/review systems are. They've been completely bypassed and never triggered.
replyArguably, your security shouldn't stop at internal code review and should aim at protecting key distribution platforms credentials and assets that are pushed to your users.
replyYeah, it shouldn't. But at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly. We know it isn't and it's not at that level, because anthropic employs engineers.
reply> at that point it's not "Why didn't Claude detect the hack" but rather "Why isn't Claude running all processes at your company autonomously", which is a bit silly.
replyWould be nice to have some words from them understanding how they manage this, what went wrong, how they'll prevent this in the future. We don't have any RCA, maybe there is little to nothing to blame them.
Not sure they'd share your views on using Claude for security policy/coverage being silly.
As an aside, it would be neat if publishing services like this had a sort of 2FA, eg the package manager had a hook endpoint where it sent the details of the next requested published version. Allowing the owners to validate.
replyKinda like 2FA on the deployment itself, not just 2FA on the .. A. I guess 2FD heh.