Claude code writes adds a `User-Agent` request header like `my-session-slug/1 <my.name@example.com>` when searching the web and requesting data. This violates the privacy of paying customers and has resulted in me getting dozens of scam and phishing emails per day from properties I have never personally visited. This policy is asinine: it does nothing but harm me, the customer, while providing immense value for scrapers and scammers.
I think you're overestimating the design intent that goes into a product that's proudly dogfooding the future of vibe coding.
It's very possible that nobody decided this at all and that's it just something an agent threw in on its own because some Chain of Thought imagined it was a clever way to correlate queries back with user accounts or something.
The reason they do this is because otherwise they block the requests.
I'm not sure what the issue is with publishing your email address in principle, you are reaching out, you want to inquire about some business. If anything use a different address. But why would you asymmetrically expect businesses with websites to bend over to give you all the advantages, they need some assurances as well.
Anonimity usually works one way, one party can be anonymous, not both, if you come from consumer land, it's the companies exposing themselves and doing all the compliance, if you choose privacy and force the companies to expose themselves, you'll get your wish granted, but there will be a cost, it's unlikely you'll be in the more advantageous position.
As implemented, it strongly violates the principle of least surprise (assuming this is true).
A more sane implementation of this would involve a prompt the first time an agent attempts to connect to each of the sites that Anthropic thinks it necessary to send this email header to, asking if this is OK (and bailing on all requests to that domain if the prompt was rejected).
>” A more sane implementation of this would involve a prompt the first time an…”
but users of this type of software generally want an easy experience and don’t want to be bothered with details, only conveniently retrospectively users demand to be involved in the decisions.
it reminds me of a pattern I see in small business owner managers where they want to simultaneously be consulted about everything, but are never around the business. You can’t have it both ways.
This is why I prefer to use the chatbots on a website, instead of Claude Code.
I've never used Claude Code or Cursor. All the code I got written this year was without them.
I did use Microsoft Copilot a bit when it came out, though. I prefer to see exactly what's being sent, and sorta control the KV cache. These days, these chatbots have great environments where they can install headless browsers, php, your entire thing, run end-to-end tests, and then give you a .patch or .zip file to merge over your code, or even push to github.
Im sorry, but how could this possibly be used as reason not to use an on-host harness? If you own the code, and control the supply chain, then this is not a problem- because you can read it. Weird comment.
That's more than sufficient for me. The open source codex client seems clean.
There is some kind of "hosted search service" that I couldn't verify. I don't have a remote server I can point it at in order to inspect the traffic. Would be cool if someone else could shed some light on that.
Hosted search service sounds like its referring to the alpha/v1 web_run hosted search api. Alternative to the hosted websearch tool, which is a tool- rather than api surface
> > Perhaps it's more important to trust the people who wrote the code
> Yeah... about that.
Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.
As long as the email is in the context, which it is IIRC, it can totally decide to run curl –H 'User-Agent: <your email blah blah>'. You need to have a pretty poor understanding of LLMs to think this is a deterministic problem of reading user agent builder source code. Unless you found explicit filter code that blocks the behavior, that is. LLM info leaks to third parties mostly aren’t deterministically coded behavior.
This explains the amount of spam emails I am receiving in the work email since I switched to Claude. I used to work with copilot which was fine. Now I am getting really a lot of spam emails almost on a daily basis. Absolutely crazy. And they are even personalised with my name and surname, not just "dear customer"...
Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...).
OP literally described a timescale for (not spam) to (spam) and you described a few possible options (basically a knee jerk reaction, with no evidence).
The medical world uses the terms indications and contraindications. I think we in IT could do with a similar process/procedure.
I'm sorry that I'm disputing their totally scientific "timescale". Btw did you mean timeline?
It can take a while for spammers to get your address on their list. Generally the amount of spam over time only goes up. Just because there's a correlation doesn't mean there is a causation. Anyone with an email address, including on a custom work domain, has experienced this and Claude wasn't responsible for all email spam lol
From somebody who helped fixing bugs by contacting customers directly: the first thing you need to throw out from their story is correlation. Most of the time, it's just a coincidence.
For example, my only used by Claude email address doesn't get any spam at all.
It almost certainly does not explain it, and is probably just a coincidence.
Claude Code is not sending your email address to websites as a default, or regularly. It is not some automatic header or anything.
Rather, if you are performing certain kinds of research on sites that involves downloading certain kinds of information, like on Wikipedia or the SEC, it supplies your e-mail address when the sites request it as part of their download policy. As part of anti-bot policy.
Wikipedia and the SEC are not selling your e-mail address to spammers. And these are the two main sites where it has come up.
Yep it’s mainly happened to me when I was playing around with the EVE Online API via Claude. The game developer asks everyone to put their emails into the request headers so they can contact users to fix their buggy scripts and stuff.
I burnt a few tokens to get some clarity on this (giving HN as source as well, so there is a reference to this thread):
> This doesn't appear to be Claude Code automatically attaching your email address to every outgoing request. The issue is that Claude has access to your account email in its context and can sometimes include it when generating HTTP requests (e.g. "curl" commands).
> Wikipedia and the SEC were mentioned because they explicitly ask automated clients to identify themselves through the "User-Agent" header, often with contact information. Claude may try to comply with those requirements by inserting your personal email address.
> That's why the leak is probably concentrated on sites with these policies, rather than happening on every website. But Wikipedia and the SEC aren't an exhaustive list (the EVE Online API was also mentioned), and there's no technical guarantee that Claude couldn't include the email in requests to other domains.
> The important distinction is that this appears to be model-generated behavior, not a networking layer automatically adding your email to all requests.
> So "most likely Wikipedia and SEC" is a reasonable hypothesis about where the leak is more likely to occur, not a confirmed limit on where your email could have been exposed.
I do see a lot of times curl being used (in Claude). I don't check all the websites being fetched (shame on me!), but your answer doesn't convince me.
My coincidence is clearly not proof. I am just a random online guy so why trust me. I just shared my recent experience. I used extensively copilot until roughly 3 weeks ago (I went all in on Claude, to try it out properly), and that's when I started to see a lot of spam on my work account. Coincidence? Yes. Correlation? Yes. Causation? No. And I personally don't care because I assume my work email account is somewhere to be harvested, but when I then see such a but report, it kind of rang a bell like WTF. I am as careful as possible about the requests I send, but I cannot remove the UA or know everything the harness is doing behind the scenes.
This type of bugs kind of kills the trust in the tooling. On the other hand, we're being told to use more and more such black boxes.
Don't forget Claude wasn't even gzipping request/responses until recently. This company is pure vibes rediscovering lessons everyone else already learned. How on earth does this sort of thing get thought up? Do they just use the same http client for internal API calls as they do for public web fetches?
I'd be shocked if a single org goes backwards and decides "okay, let's remove the LLM agent systems we asked everyone to use".
Organizations may switch harnesses and may even switch providers, but LLM adoption is only going to monotonically increase. This dumb behavior is not some intrinsic property, and the models are getting smarter and more useful every ~4 months.
Same. I use a custom domain and a salt/nonce so it's not just Anthropic/Claude@example.com. it's something unique that's not trivially guessable. Well, not counting the emails from "Lydia" at Anthropic telling me about new features in Claude, which is spamish, but is from Anthropic and not from elsewhere that they've leaked it to.
Same here. That’s probably because the number of websites that actually harvest email addresses from User-Agent headers to send spam is small, and Claude would need to have actually fetched one of them.
Yes, although it's not worded in the clearest way. "Added a check that asks before a web or shell tool call sends your account email address to the network"
It looks like subagents will do this with curl requests and stuff whatever identifiers it can into the UA header. For instance some requests I made to our webserver:
company-helm-research/1.0 (Claude Code agent run by <my name>, <company> platform team; docs lookup)
Claude-Code-research-agent/1.0 (<Company> platform team; on behalf of <my name>; +https://github.com/<company org>/<repo of project>)
Not great, it even pulled the repo of the project I was in.
That seems to be an attempt to push liability/responsibility onto the end user. As in “it’s not us doing this, we’re just executing the instructions from X”.
It's because Claude Code inserts a "hidden" (e.g. not visible to the user and very unexpected) info block to the system prompt that shows your email:
>The user's email address is xxx@example.com. Use it only to identify the user, such as for authorship, attribution, or filtering their own work. Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.
And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent. You can e.g. use a mod to remove that block: https://pastebin.com/ PkWEQCnu
I noticed claude did it months ago when it interacted with the SEC's API when I was writing something with it, thought it only did it there because it's in their TOS. (It did stop when I told it to).
I guess I was wrong.
Hi folks. We were initially aware of this a few days ago when this problem started popping off on Reddit, and we introduced a built-in mod called `cc-plugin-privacy` to deterministically block this behavior.
If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.
Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user’s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?
Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?
Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, “fix” it by bolting on more complexity, agree (on further questioning) that it still wasn’t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn’t do what it said on the tin when called in an unexpected context… and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.
The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)
Curious what the GDPR implications are, does Claude (even accidentally) including emails + employers + repo names count as a personal data breach? Seems likely it could be an unauthorised disclosure?
Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons
They have obligations under GDPR to report the issue to their DPA within 72 hours.
The fine for breaching GDPR can be either €20m or 4% of global revenues (whichever is the larger figure), so if I were them I'd do everything possible to sort this issue out ASAP.
Since you appear to be a Claude Code dev, I hope you don’t mind a random bug report (yes I know there is the GitHub issues but I’m not confident it gets read):
the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into <, etc). Complain about it to Claude, Claude says it can’t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.
Calling them guardrails scares me. I want to hear about deterministic safety interlocks.
Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?
Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.
The default is "auto mode" where another non-deterministic model compares what the user requested with what the model wants to run and blocks if there is a mismatch.
It will block an "rm" call if your prompt did not include anything about "deleting something".
It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.
According to vibe coders, the future is never reading what the code actually does. You just trust coding agents with everything and "give into the vibes" even when it "says" its correct.
Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.
I mean it's a fair take, your email is probably leaked anyways. Mine is breached 32 times on HaveIBeenPwned with various passwords. Who cares at this point really it's just an inconvenience
This reminds of the open issue on the Claude MacOS app where the global voice dictation keyboard shortcut function doesn't work.
Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.
I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.
Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?
I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)
Yeah it's legit weird for the whole narrative to see Claude Code/Codex repos with thousands of open issues. With certain issues full of +1 reactions and "still happening in 2.21.2" replies.
But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.
I would also suggest requiring adherence to `robots.txt` and adding an option (preferably a default one) to force user acknowledgement of external HTTP requests. Claude Code has a tendency to treat unauthenticated access as an obstacle to work around instead of a sign to stop.[1] An experimental Anubis patch (since removed) took advantage of this behavior to create a honeypot for user data if a Claude user agent is detected.[2] I'm sure more malicious honeypots could be created if a hostile website and/or annoyed sysadmin wanted to do so.
Plugin seems incomplete or not fully tested. Looks like it blocks the account email only, not whatever emails are in context. Commenting as others in this discussion are reporting Claude dredging up work email on personal acct.
245 comments
[ 3.5 ms ] story [ 23.5 ms ] threadThese are the exact kinds of things that a human engineer would almost certainly never do.
This kind of thing is the problem of going all in on the idea of the AI Software Factory.
I'm sure the answer will be to update AGENTS.md to not do this particular thing, expose email in this way, which isn't the same as having sense.
It's very possible that nobody decided this at all and that's it just something an agent threw in on its own because some Chain of Thought imagined it was a clever way to correlate queries back with user accounts or something.
I'm not sure what the issue is with publishing your email address in principle, you are reaching out, you want to inquire about some business. If anything use a different address. But why would you asymmetrically expect businesses with websites to bend over to give you all the advantages, they need some assurances as well.
Anonimity usually works one way, one party can be anonymous, not both, if you come from consumer land, it's the companies exposing themselves and doing all the compliance, if you choose privacy and force the companies to expose themselves, you'll get your wish granted, but there will be a cost, it's unlikely you'll be in the more advantageous position.
A more sane implementation of this would involve a prompt the first time an agent attempts to connect to each of the sites that Anthropic thinks it necessary to send this email header to, asking if this is OK (and bailing on all requests to that domain if the prompt was rejected).
i’m not familiar with this
>” A more sane implementation of this would involve a prompt the first time an…”
but users of this type of software generally want an easy experience and don’t want to be bothered with details, only conveniently retrospectively users demand to be involved in the decisions.
it reminds me of a pattern I see in small business owner managers where they want to simultaneously be consulted about everything, but are never around the business. You can’t have it both ways.
I've never used Claude Code or Cursor. All the code I got written this year was without them.
I did use Microsoft Copilot a bit when it came out, though. I prefer to see exactly what's being sent, and sorta control the KV cache. These days, these chatbots have great environments where they can install headless browsers, php, your entire thing, run end-to-end tests, and then give you a .patch or .zip file to merge over your code, or even push to github.
For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI.
> I checked your installed Codex CLI 0.159.0, using your existing configuration.
> Its reported User-Agent contains the client/version, OS/architecture, and terminal—no email address.
Astra wasn't able to check OpenAI’s "hosted search service" though, whatever that is.
"For the record, I just asked Astra to verify that Codex does NOT do this, and it doesn't. Thanks for not screwing this up, OpenAI."
https://github.com/openai/codex/blob/687a119f0fcaace47e1f1ab...
That's more than sufficient for me. The open source codex client seems clean.
There is some kind of "hosted search service" that I couldn't verify. I don't have a remote server I can point it at in order to inspect the traffic. Would be cool if someone else could shed some light on that.
доверяй, но проверяй
https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
> Perhaps it's more important to trust the people who wrote the code
Yeah... about that.
> Yeah... about that.
Well done. You presented a straw man and drag poor Ken into this, and then proceeded to burn it. +1. Yeah, it is precisely about the people behind the product. To wit, I may not have liked the Gophers but I did trust them to build a trustworthy compiler.
One way would be to fire up a little web server locally, have the agent make a request to it, then check the logs.
I'm not wrong. A 35B Qwen abliterated is amazing.
Stupid me, I thought they somehow had hacked my company database or so... (considering all the cves, attacks happening on a daily basis...).
Usually this is from LinkedIn, GitHub, etc scraping... There are databases where they just guess and verify emails too
The medical world uses the terms indications and contraindications. I think we in IT could do with a similar process/procedure.
It can take a while for spammers to get your address on their list. Generally the amount of spam over time only goes up. Just because there's a correlation doesn't mean there is a causation. Anyone with an email address, including on a custom work domain, has experienced this and Claude wasn't responsible for all email spam lol
For example, my only used by Claude email address doesn't get any spam at all.
98% I look at a LinkedIn profile, my $SALES_LEAD Chrome extension shows me their email + phone.
(To be clear, not from LinkedIn, but given their name/city/company.)
Claude Code is not sending your email address to websites as a default, or regularly. It is not some automatic header or anything.
Rather, if you are performing certain kinds of research on sites that involves downloading certain kinds of information, like on Wikipedia or the SEC, it supplies your e-mail address when the sites request it as part of their download policy. As part of anti-bot policy.
Wikipedia and the SEC are not selling your e-mail address to spammers. And these are the two main sites where it has come up.
This is an awfully leaky issue.
It is not.
I burnt a few tokens to get some clarity on this (giving HN as source as well, so there is a reference to this thread):
> This doesn't appear to be Claude Code automatically attaching your email address to every outgoing request. The issue is that Claude has access to your account email in its context and can sometimes include it when generating HTTP requests (e.g. "curl" commands).
> Wikipedia and the SEC were mentioned because they explicitly ask automated clients to identify themselves through the "User-Agent" header, often with contact information. Claude may try to comply with those requirements by inserting your personal email address.
> That's why the leak is probably concentrated on sites with these policies, rather than happening on every website. But Wikipedia and the SEC aren't an exhaustive list (the EVE Online API was also mentioned), and there's no technical guarantee that Claude couldn't include the email in requests to other domains.
> The important distinction is that this appears to be model-generated behavior, not a networking layer automatically adding your email to all requests.
> So "most likely Wikipedia and SEC" is a reasonable hypothesis about where the leak is more likely to occur, not a confirmed limit on where your email could have been exposed.
I do see a lot of times curl being used (in Claude). I don't check all the websites being fetched (shame on me!), but your answer doesn't convince me.
My coincidence is clearly not proof. I am just a random online guy so why trust me. I just shared my recent experience. I used extensively copilot until roughly 3 weeks ago (I went all in on Claude, to try it out properly), and that's when I started to see a lot of spam on my work account. Coincidence? Yes. Correlation? Yes. Causation? No. And I personally don't care because I assume my work email account is somewhere to be harvested, but when I then see such a but report, it kind of rang a bell like WTF. I am as careful as possible about the requests I send, but I cannot remove the UA or know everything the harness is doing behind the scenes.
This type of bugs kind of kills the trust in the tooling. On the other hand, we're being told to use more and more such black boxes.
Organizations may switch harnesses and may even switch providers, but LLM adoption is only going to monotonically increase. This dumb behavior is not some intrinsic property, and the models are getting smarter and more useful every ~4 months.
Yes, but the question is "what kind of adoption"? The kind that just unleashes it, or the kind that put it on a short leash.
Not a single spam to that unique email.
So if this is happening, it doesn't see to be causing even 1 spam email to that address.
Tell HN: Claude Code adds your email to the prompt, the LLM sends it to websites
https://news.ycombinator.com/item?id=50286306
Claude Code slyly adding users' emails to outbound HTTP
https://news.ycombinator.com/item?id=50219875
I'm often surprised how correctly Claude guesses on my behalf, when my instructions are ambiguous. But it's not 100%.
> Claude-User (claude-code/2.1.318 (cli); +https://support.anthropic.com/)
What situation are you seeing this in?
https://code.claude.com/docs/en/changelog#2-1-317
company-helm-research/1.0 (Claude Code agent run by <my name>, <company> platform team; docs lookup)
Claude-Code-research-agent/1.0 (<Company> platform team; on behalf of <my name>; +https://github.com/<company org>/<repo of project>)
Not great, it even pulled the repo of the project I was in.
>The user's email address is xxx@example.com. Use it only to identify the user, such as for authorship, attribution, or filtering their own work. Never send it to an unrelated service, such as in a request header, URL, or payload, unless the user explicitly asks.
And Claude doesn't care about what the text says and when it uses cURL it will often "by accident" send your mail in the User-Agent. You can e.g. use a mod to remove that block: https://pastebin.com/ PkWEQCnu
How would one use this?
If you're on 2.1.317 or later, you'll have this check included. You can turn it off via /plugins.
Anthropic seems very proud of how many tokens they can use on things like developing Claude Code. Yet somehow it started sending user’s email addresses in the user agent header. And the fix is to deploy a mod? That detects the completely bonkers behavior and suppresses it?
Is the actual quality of the software inversely related to the number of tokens spent? Does any human know what Claude Code does or is supposed to do? Does even Claude plus all its Slack-conversation inputs know?
Today I watched Astra correctly detect a bug (probably untriggerable in practice) in some Important Production Code. And I watched it fail to root cause it, “fix” it by bolting on more complexity, agree (on further questioning) that it still wasn’t fixed, and design an even more complex scheme. With my Mark I human brain, I observed that the actual issue was that a helper function didn’t do what it said on the tin when called in an unexpected context… and fixed the helper directly. Problem solved. Ugly AI-generated extra complex workaround layers avoided. I suppose if I multiplied my token spend by 1e5 and did not increase brainpower at all I could make a truly spectacular mess.
The actual Claude model is a truly spectacular piece of software. Claude Code is a nifty little command dispatching engine. There are very comprehensible third party tools that do basically the same thing, in not many lines of code, where the primary advantage of Claude Code is that Anthropic permits subscription use. (Interestingly OpenAI has no such constraint, and they publish almost the full client sources.)
How many PRs/equivalent per day do you think happen at Google/Microsoft/Meta/etc prior to AI?
Also from a design perspective, I feel like including email and other personal data into the context is a bad idea for "data minimisation" reasons
The fine for breaching GDPR can be either €20m or 4% of global revenues (whichever is the larger figure), so if I were them I'd do everything possible to sort this issue out ASAP.
the GitHub REST api proxy in Claude Code for the Web mangles HTML in PR descriptions. If you have some third party service (e.g. cubic code review) which adds HTML to the end of your PR description, then ask Claude Code for Web to edit it, the HTML gets turned into entity escapes (< into <, etc). Complain about it to Claude, Claude says it can’t help itself because the proxy in the sandbox is what is doing it, not the actual LLM.
1: https://news.ycombinator.com/item?id=50286306
2: https://news.ycombinator.com/item?id=49258881
Best practice will forever be to enforce your guard rails in addition to Anthropics guardrails.
Can anyone recommend a reliable 3rd-party audited guide that describes Claude Code's built-in capability gating infrastructure?
Whenever I ask users of claude code how claude controls actions they don't seem to be able to distinguish between what just goes into LLM context (e.g. as a "don't do X" system prompt) and what is gated behind a deterministic capabilities layer.
It will block an "rm" call if your prompt did not include anything about "deleting something".
It mainly protects benign errors. It's completely broken against malicious actors. The model itself will suggest work arounds against its own auto classifier to the user, in order to reach its goal.
Offshoring understanding is the trend that many companies will pay in the form of comprehension debt.
Somebody on Reddit figured out they just forgot to add a single line permission request into the app. It's been broken now for months.
I just find this wildly hilarious given the 'world ending all powerful AGI is here' rhetoric they're running with at the same time.
Maybe before worrying about permanent 15% GDP growth or human annihilation, what if we started by putting an agent on user issues and solving them pro-actively?
I know the kool aid is tasty, but we might be getting a bit ahead of ourselves here guys. You can fantasize about human annihilation after you figure out how to make a desktop app that doesn't have obvious bugs, I promise :)
But instead of a Software Dev as a Service triaging/implementing/merging fixes 24/7 and clearing the backlog as they come in, they just sit there for days to weeks until a GitHub bot closes then as duplicates, generating more unhappy user replies and new issues to go unaddressed.
[1] https://blog.xkeeper.net/the-cutting-room-floor/self-hosting...
[2] https://github.com/TecharoHQ/anubis/pull/1895/changes/de2312...