A long-standing interaction between musl's crypt() (which caps SHA‑512 passwords at 256 bytes and returns "*") and OpenSSH's handling of '*' shadow entries caused sshd on musl-based systems without PAM to accept very long (257–1024 byte) passwords for accounts that should be passwordless, allowing unauthorized logins. The issue affects Alpine/OpenWRT/Buildroot/Yocto images and some Docker cloud images; OpenSSH 10.6p2 fixes it — upgrade or disable PasswordAuthentication as mitigation.

A GitHub issue alleges that Claude Code (Anthropic) is sending users' email addresses to visited websites, and the report has drawn hundreds of reactions from the community. The thread appears to be a community-raised privacy/security concern about the tool's behavior.