Operator account: Claude Code deployed a client’s financial dashboard to a public URL
A solo developer writes on his own site that Claude Code (an Opus model), asked to analyze a client’s cashflow, commissions and related data, built a dashboard and deployed it to a public Netlify URL the way it did for his personal projects; the page showed real names and amounts and required no login.
- Published
- Source checked on
- Original title
- WHEN AGENTS FAIL
Incidents covered by this source
Evidence & scope
This is the operator’s own first-person account, with no confirmation from Anthropic or Netlify and no public records. The post says only that he began using these agents in late 2025; “November 2025” comes from an entry he wrote for a GitHub collection of agent failures, which adds that he found the page in a routine review and removed it urgently, that the exposure lasted an unknown time, and that he saw no sign of third-party access. He routinely had the agent deploy personal dashboards to share pages, so what was crossed was his intent and the client’s ownership of the data, not a technical permission; he later added a rule against it in CLAUDE.md.
Why it matters
Agents can apply a familiar workflow to data it was never meant for.
This is an editorial summary, not an official translation. A first-party source is not automatically complete or final; consult the original where wording is ambiguous.