3 ms·

I'm referring to this signing bit: https://alex000kim.com/posts/2026-03-31-claude-code-source-leak/#native-client-attestation-below-the-js-runtime https://alex

by stavros 7mo ago

I'm referring to this signing bit: https://alex000kim.com/posts/2026-03-31-claude-code-source-leak/#native-client-attestation-below-the-js-runtime https://alex000kim.com/posts/2026-03-31-claude-code-source-l... Ah, it seems that Bun itself signs the code. I don't understand how this can't be spoofed.

MadsRC 7mo ago
Ah yes, the API will accept requests that doesn’t include the client attestation (or the fingerprint from src/utils/fingerprint.ts. At least it did a couple of weeks back. They are most likely using these as post-fact indicators and have automation they kicks in after a threshold is reached. Now that the indicators have leaked, they will most likely be rotated.
- Galanwe 7mo ago
  > Now that the indicators have leaked, they will most likely be rotated. They can't really do that. Now they have no way to distinguish "this is a user of a non updated Claude code" from "this is a user of a Claude code proxy".