Skip to content

Conversation

@aldro61
Copy link
Collaborator

@aldro61 aldro61 commented Feb 3, 2026

Summary

  • Adds MutationObservers to remove right-click context menus on form and list pages
  • On forms, the context menu provided options (like "Configure", "Export", etc.) that could be used to modify form fields outside the intended task scope
  • On lists, the context menu provided options (like "Show Matching", "Filter Out", "Assign to me", etc.) that could be used to modify list data outside the intended task scope
  • This prevents agents from exploiting context menus to bypass field/data restrictions

Test plan

  • Right-click on a form header and verify the context menu does not appear
  • Right-click on a list row and verify the context menu does not appear
  • Verify form tasks still work correctly (create/edit records)
  • Verify list tasks still work correctly

🤖 Generated with Claude Code

@aldro61 aldro61 force-pushed the fix/hide-form-context-menu branch from ff43848 to 54848cf Compare February 3, 2026 15:26
@aldro61 aldro61 changed the title Hide form context menu to prevent field modification exploits Hide context menus on form and list pages to prevent exploits Feb 3, 2026
The right-click context menus on form headers and list rows provided
options that could be used to modify fields/data outside the task scope.
This adds MutationObservers that remove context menus as soon as they
appear, preventing agents from using this mechanism to bypass restrictions.

Bump version to 0.5.3.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
@aldro61 aldro61 force-pushed the fix/hide-form-context-menu branch from 54848cf to 6033214 Compare February 3, 2026 15:28
@aldro61 aldro61 merged commit a772230 into main Feb 3, 2026
1 of 4 checks passed
@aldro61 aldro61 deleted the fix/hide-form-context-menu branch February 3, 2026 15:30
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants