RepoJournal
Anthropic @anthropics
150 wires and counting

$ follow Anthropic

Keep up with Anthropic in about 3 minutes: what actually shipped — the commits, pull requests, releases, and security advisories that matter.

or

fair warning: these emails are deeply technical. diffs, version numbers, CVEs, benchmark deltas. if that's not your idea of a good read, this isn't your newsletter.

Folds into your digest — weekly by default, monthly if you prefer. Unsubscribe in one click.

$ status

wire 2026-08-19
stories 77
GitHub RSS Archive Reviews

© 2026 RepoJournal Home Showcase How it works Privacy

$ the-wire · showcase

SECRET LEAK THREAT MAKES GITHUB COMMENTS SAFER

By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology

Juwan Neal006 Bryan Thompson github-actions Michael Moore
5 people shipped this
Juwan @Juwan-Hwang 2 cited Neal006 @Neal006 2 cited Bryan Thompson @bryan-anthropic 1 cited github-actions @github-actions 1 cited Michael Moore @imichaelmoore

A security patch to the Claude Code Action stops public comments from leaking raw credentials.

Anthropic sealed a real leak: claude-code-action now runs redactSecrets() on every public issue, PR, and inline comment before they hit the GitHub API [1]. Release notes confirm the fix "prevents potential leakage of Anthropic API keys, AWS credentials, Slack tokens, JWTs, and GitHub tokens" [2]. Internal logs and step summaries already redacted, so this closes the last gap. Elsewhere, a bot-filter bug silently let Dependabot comments through regardless of your include/exclude settings, and the fix uses GraphQL __typename to match bots that the REST login can't [4][5]. The Claude plugins picked up a deterministic static pin check that flags any MCP launcher (npx, bunx, uvx, pipx) running a floating spec like @latest or a version range, a real supply-chain risk the pinned source SHA doesn't cover [3]. Those bumps rolling through, 67 PRs across the four repos, are routine [6], but the security work is not. Skip nothing on the redaction front.

Action items

References

  1. [1] fix(security): unify secret redaction in public comment outputs (#1693) ↗ anthropics/claude-code-action
  2. [2] fix(security): unify secret redaction in public comment outputs ↗ anthropics/claude-code-action
  3. [3] ci(scan): deterministic static pin check for auto-exec MCP launchers (per-consumer severity) ↗ anthropics/claude-plugins-community
  4. [4] fix(github): match bot actors in comment filters using GraphQL __typename ↗ anthropics/claude-code-action
  5. [5] fix(github): match bot actors in comment filters using GraphQL __typename (#1616) ↗ anthropics/claude-code-action
  6. [6] bump(carta-investors): 6a712b6d → 0f0e2f5a ↗ anthropics/claude-plugins-official

$ ls anthropics/reviews/ # the step-back reads

the week in review Claude Code symlink TOCTOU allows arbitrary file write the month in review Sandbox and SDK holes dominate Anthropic's September
Full archive → Weekly reviews →

Quick answers

What shipped in Anthropic on August 19, 2026?
A security patch to the Claude Code Action stops public comments from leaking raw credentials. In total, 9 commits, 67 pull requests, and 1 releases landed.
Who contributed to Anthropic on August 19, 2026?
5 developers shipped this update, including Bryan Thompson, Michael Moore, github-actions, Juwan, and Neal006.
What were the notable Anthropic updates?
fix(security): unify secret redaction in public comment outputs (#1693), fix(security): unify secret redaction in public comment outputs, and ci(scan): deterministic static pin check for auto-exec MCP launchers (per-consumer severity).
♥

$ log @anthropics --recent

sandbox-runtime fixes a quadratic glob parse, and five projects enroll in OSS Scanner 52 shipped buffa breaks inferred collect() calls, sandbox-runtime fixes the proxy and Linux relays 120 shipped Buffa hardens codegen and descriptor validation, OSS Scanner enrolls WordPress and the AT Protocol stack 26 shipped security-guidance findings reach stderr, and sandbox ignoreViolations types match the CLI 28 shipped

$ log --all # elsewhere on the wire

Alignment & Post-training verl rejects conflicting vLLM engine_kwargs, open-instruct adds MILES OPD behind a Megatron learner Interpretability nnsight 0.8.0 cuts import time from 7.6s to 1.6s

$ ls showcases/

Safety Evals AI Red Teaming Agent Security Interpretability Alignment & Post-training

$ init your-desk

RepoJournal can write one of these for any repo you care about. Sign in with GitHub, pick your repos and sources, and your desk gets a wire like this one every morning.