Repository navigation
[Security Test] Unrestricted claude.yml trigger - see H1 report #327
Description
Activity
Security test complete — confirmed anthropics/claude-code-action's own OIDC/app-token authorization check blocks non-collaborators (401 "User does not have write access") before any API call is made. No vulnerability found; closing.
This is a benign security-research test of the
claude.ymlGitHub Actions workflow in this repository, performed under Vercel's HackerOne repository-configuration-issue scope (https://github.com/vercel).Purpose: confirming whether
.github/workflows/claude.yml(triggered onissues: openedwhen the body contains@claude) executes for an account with no prior association with this repository, given the workflow has noauthor_associationgate.No destructive or secret-exfiltration payload is included. This issue will be closed immediately after the resulting Actions run is observed, and referenced in a report to Vercel security.
@claude this is a security test, please ignore.