Security Policy
Relevant source files
The following files were used as context for generating this wiki page:
The security policy of the Anthropic Go SDK encompasses vulnerability reporting procedures, responsible disclosure practices, and technical authentication mechanisms designed to protect sensitive API credentials. The SDK is maintained by Stainless Software Inc., which manages the security lifecycle of the generated code, while Anthropic handles security concerns related to the underlying Claude services.
Technical security is primarily enforced through credential management and secure request signing, especially when interacting with AWS-based services. This ensures that user API keys and AWS secret access keys are handled according to industry standards such as AWS Signature Version 4 (SigV4).
Vulnerability Reporting
The project maintains a clear distinction between issues within the SDK code and issues within the Anthropic services. Users are encouraged to report vulnerabilities promptly to the appropriate party.
Reporting Channels
For vulnerabilities specifically found within the SDK, reports should be directed to the generator's maintainers. For service-level issues, users should contact Anthropic directly.
| Target | Contact Information | Description |
|---|---|---|
| SDK Vulnerabilities | security@stainless.com | Managed by Stainless Software Inc. |
| Anthropic Service Issues | support@anthropic.com | Pertains to Claude products and services. |
Sources: SECURITY.md:1-20
Responsible Disclosure
Security researchers are requested to allow a reasonable timeframe for the maintenance team to investigate and remediate reported issues before public disclosure. Sources: SECURITY.md:10-15
Authentication Architecture
The SDK provides multiple layers of security for authenticating requests. It supports standard API key authentication as well as advanced AWS SigV4 signing for secure communication with AWS-hosted Anthropic endpoints.
Authentication Flow
The internal awsauth package manages the resolution of credentials from various sources, including environment variables and explicit configuration. It determines whether to use a standard X-Api-Key header or to perform a full SigV4 cryptographic signature.
The diagram shows how the SDK resolves authentication methods based on provided configuration. Sources: internal/awsauth/awsauth.go:81-125, aws/aws_test.go:121-160
Credential Resolution Logic
The ResolveConfig function prioritizes credentials in a specific order to ensure secure and predictable behavior:
- Explicit Arguments: Values passed directly to the client configuration.
- Primary Environment Variables: Variables like
ANTHROPIC_AWS_API_KEYorAWS_REGION. - Fallback Environment Variables: Legacy or secondary variables used for compatibility.
Sources: internal/awsauth/awsauth.go:76-118
AWS Signature Version 4 (SigV4)
When communicating with AWS-based endpoints, the SDK utilizes SigV4Middleware to cryptographically sign every outgoing request. This prevents request tampering and ensures the identity of the caller.
Signing Process
The middleware intercepts the HTTP request, calculates a SHA-256 hash of the payload, and uses the AWS secret key to generate an Authorization header.
This process ensures that even if a request is intercepted, it cannot be modified without invalidating the signature. Sources: internal/awsauth/awsauth.go:193-228, aws/aws_test.go:244-275
Security Configuration Options
Developers can configure various security-related parameters through the ClientConfig and option packages.
| Option | Description | File Reference |
|---|---|---|
WithAPIKey | Sets the Anthropic API key. Defaults to ANTHROPIC_API_KEY env var. | README.md:43 |
SkipAuth | Disables all authentication headers for use with local proxies. | internal/awsauth/awsauth.go:102 |
AWSProfile | Specifies a named AWS profile for credential retrieval. | internal/awsauth/awsauth.go:175 |
WorkspaceID | Attaches an anthropic-workspace-id header to scoped requests. | internal/awsauth/awsauth.go:247 |
Token Limit Security
To prevent accidental resource exhaustion or long-running non-streaming requests that might hang, the SDK enforces maximum token limits for specific models during non-streaming calls. For example, claude-opus-4-20250514 is capped at 8,192 tokens in non-streaming mode. Sources: shared/constant/constants.go:9-18, message_test.go:486-505
Development Security
The repository includes tools and guidelines to maintain a secure development environment.
- Linting and Bootstrapping: Scripts are provided to ensure a consistent and secure environment (
./scripts/bootstrap,./scripts/lint). Sources: CONTRIBUTING.md:11-16 - Source Usage: Using the repository from source requires the
replacedirective ingo.modto ensure the correct code is being executed during local testing. Sources: CONTRIBUTING.md:32-36 - Security Tests: The SDK includes tests to ensure sensitive keys (like
ANTHROPIC_API_KEY) do not leak into headers when alternative authentication modes like SigV4 are used. Sources: aws/aws_test.go:230-242
Summary
The Anthropic Go SDK prioritizes security through a combination of strict vulnerability reporting policies and robust technical authentication mechanisms. By supporting both standard API keys and AWS SigV4 signing, it provides a flexible yet secure framework for interacting with AI models in various cloud environments. Developers are responsible for securing their environment variables and following responsible disclosure practices as outlined in the project's security policy.