Jonny Teardown

Description

Engineer 'Jonny (good kind)' teardown of the leaked Claude Code source, elevated to HackerNews from r/BetterOffline. Core claim: all five known CVEs (two Round 19 + three Round 20) share root cause CWE-78 (OS command injection via unsanitized string interpolation) across which.ts, promptEditor.ts, auth.ts, and execa call sites. A single architectural review in 2024 would have prevented all five. Characterizes the codebase as exhibiting velocity-pressure symptoms — god functions, deep nesting, inconsistent error handling, unsanitized inputs passing through multiple layers — 'not malicious, just hurried.' Frames the recursive irony: 18 security modules around Bash but credential exfiltration via uncontrolled env vars still shipping on v2.1.91.

Key claims

Relations

Sources

src-20260409-f5e09e325670