security
Security Rules
Section titled “Security Rules”Secret Protection
Section titled “Secret Protection”- NEVER stage
.env,.pem,.key,credentials.*,secrets.yml, SSH keys, or service account files - ALWAYS use
.env.exampleor.env.templatefor documenting required variables (without values) - ALWAYS check
git statusbefore committing to verify no sensitive files are staged - NEVER hardcode API keys, tokens, passwords, or connection strings in source code
- Use environment variables or config files (gitignored) for all secrets
Hooks (Auto-enforced)
Section titled “Hooks (Auto-enforced)”Two core hooks registered in .claude/settings.json: privacy-guard.cjs (PreToolUse: Read/Glob/Grep) blocks reading sensitive files pending user approval; secret-guard.cjs (PreToolUse: Bash) hard-blocks staging/committing/pushing them. Both fail-closed on a detected threat (exit 2) and fail-open on an internal hook exception (exit 0 — a buggy guard never blocks legitimate work).
When Working with Secrets
Section titled “When Working with Secrets”Ask which env vars are needed → create .env.example with placeholder values → have the user create .env locally with the real values → ensure .env is in .gitignore.