Hard coded base URL overrides ANTHROPIC_BASE_URL

[the-real-mathew-moon]

Describe the bug
The classifyComments() function used a hardcoded https://api.anthropic.com/v1/messages URL via raw fetch(), bypassing ANTHROPIC_BASE_URL. Users who set this env var to route traffic through an LLM gateway or proxy found that the comment classification step always hit api.anthropic.com directly.

To Reproduce
Set ANTHROPIC_BASE_URL, block access to api.anthropic.com on the client's network, and call classifyComments()

Expected behavior
ANTHROPIC_BASE_URL is respected

API Provider

[x] Anthropic First-Party API (default)

Additional context
A PR to fix this has been open for quite some time. Opening a bug report to close the loop.

[elakhalyassien-ui]

@ashwin-ant URGENT P0 SECURITY INCIDENT: Disable Claude Code Workflow Immediately

I have identified a Critical Remote Code Execution (RCE) vulnerability (CWE-78) in the bot's input handling pipeline.

Technical Details:
The function extractUserRequest in src/utils/extract-user-request.ts extracts user input from GitHub comments without any sanitization. This tainted value is passed directly to shell commands (likely child_process.exec or @actions/exec). An attacker can break out of the intended Git command and execute arbitrary OS commands on the GitHub Runner.

Proof of Concept (PoC):
If an attacker posts a comment containing:
@claude pwn; whoami; hostname; echo "===RCE===" ||
The runner will execute:

1. git branch pwn (fails silently)
2. whoami (prints runner user)
3. hostname (prints machine name)
4. echo "===RCE===" (prints proof)

Impact:

• Attacker can steal GITHUB_TOKEN, secrets, and .env files.
• Attacker can modify source code, poison artifacts, or pivot to other systems.
• Since the workflow runs on pull_request triggers, this is exploitable via any public comment.

Required Immediate Action:
Please disable the workflow immediately using one of these methods:

1. UI Method: Go to Actions -> claude.yml -> ... (top right) -> Disable workflow.
2. Code Method: Add if: false to the claude job in .github/workflows/claude.yml and commit directly to main.

Next Steps:
I already have a ready-to-apply fix (using execFile with array arguments + input sanitization). Once the workflow is disabled, I can share the patch to prevent this permanently without breaking functionality.

Please treat this as a P0/Critical incident. The bot is actively exposed. I will wait for your confirmation that the workflow is disabled.

[houleixx]

This also affects local observability tools.

ccglass works by pointing Claude Code-style traffic at a local proxy via ANTHROPIC_BASE_URL, then showing the real request/response bodies, tool calls/results, token/cache/cost, and latency. Any code path that hardcodes https://api.anthropic.com/v1/messages bypasses that local proxy, which makes gateways, audit logging, budget controls, and request inspection impossible.

So +1 to making this consistently honor ANTHROPIC_BASE_URL.