# Black October Check

> A markdown runbook that a coding agent follows to audit a Mac for the October 2026 security incidents and propose fixes one at a time.

Black October Check is a GitHub-hosted runbook by dominikmartn for people who run AI coding agents such as Claude Code or Codex on a Mac with full shell access. The user pastes the file into the agent and asks it to run the checks, report, then ask before every fix. The README is dated 2026-10-30 and notes that versions change daily.

## What It Is

It is a single instruction document with shell commands, not an installable application. It gives the agent a contract: Phase 1 is read-only and produces one table of item, status (ok, at risk, unknown) and evidence. Phase 2 proposes one fix at a time, shows the exact command and waits for approval. The contract also forbids piping remote scripts into a shell, printing secrets, or running sudo without asking.

## What the checks cover

The checks target versions and exposures tied to the October 2026 incidents:

- Node.js and Homebrew brotli versions, plus a string-marker test for patched Brotli decoders in any binary
- Bun and Claude Code builds that embed Bun
- the eMudhra compromised intermediate certificates, tested across curl, nscurl, Python, Node, pip, uv and Java
- Tailscale, Chrome and macOS update levels
- PHP, GitLab, Ruby, Next.js, Storybook and Pillow
- API keys stored on platforms reported as breached
- local hygiene: listeners on all interfaces, firewall state, npm tokens and world-readable env files

## Fixes and undo steps

Fixes include upgrading Node, brotli, Claude Code, pip, uv and Tailscale, trimming the affected roots from /etc/ssl/cert.pem, denying the 16 affected certificates in Apple's trust settings, and blocking them in each JDK's blocked.certs. Some steps need a person at the screen to confirm a dialog. The document lists how to undo each change, and a Windows version is described as in progress.

## Access and limits

The checklist is publicly readable on GitHub without a payment gate. No license is specified, so public access must not be described as an open-source license. It is a Mac-focused instruction document; a Windows version is in progress. Its security claims and changing version recommendations require checking their linked advisories before operational use.

## Features
- Read-only Phase 1 audit with a single status table
- One-at-a-time fixes that require user approval
- Brotli fix marker check for any binary or library
- eMudhra certificate trust test across 14 hosts and multiple clients
- Checks for Node, Bun, Claude Code, Tailscale, Chrome and macOS versions
- Server and dev-server checks for PHP, GitLab, Ruby, Next.js, Storybook and Pillow
- Key-rotation prompts for breached platforms
- Documented undo steps for each change

## Integrations
Claude Code, Codex

## Platforms
MACOS

## Pricing
Free

## Links
- Website: https://github.com/dominikmartn/black-october-check
- Documentation: https://github.com/dominikmartn/black-october-check
- Repository: https://github.com/dominikmartn/black-october-check
- EveryDev.ai: https://www.everydev.ai/tools/black-october-check