{"slug": "como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos", "title": "Cómo evitar que Claude Code borre tu proyecto: hooks de seguridad en 5 minutos", "summary": "A developer published a set of Claude Code PreToolUse hooks that block destructive shell commands such as recursive rm on / or ~, git push --force, git reset --hard, and curl piped to sh by exiting with code 2, which cancels the action and returns the error message to Claude so it can revise its plan. The hooks are configured in .claude/settings.json and verified by piping sample tool_input JSON into the script to confirm exit codes 2 and 0. A companion hook blocks reads and writes to .env, *.pem and id_rsa files while allowing .env.example.", "body_md": "Los agentes de código son increíbles… hasta que ejecutan `git reset --hard` sobre una tarde de trabajo sin commitear.\n\nClaude Code tiene una función poco conocida para evitarlo: **los hooks**.\n\nUn script que Claude Code ejecuta **antes o después** de usar una herramienta. Si un hook `PreToolUse`\n\ntermina con **código de salida 2**, la acción se cancela y Claude recibe tu mensaje de error, así que corrige su plan solo.\n\n`.claude/hooks/bloquear.py`:\n\n``` python\n#!/usr/bin/env python3\nimport json, re, sys\nPATRONES = [\n    (r\"\\brm\\s+-[a-zA-Z]*[rR][a-zA-Z]*f?\\s+(/|~|\\$HOME|\\*)(\\s|$)\", \"rm recursivo sobre /, ~ o *\"),\n    (r\"\\bgit\\s+push\\b.*(--force\\b|-f\\b)(?!-with-lease)\", \"git push --force\"),\n    (r\"\\bgit\\s+reset\\s+--hard\\b\", \"git reset --hard\"),\n    (r\"(curl|wget)[^|]*\\|\\s*(sudo\\s+)?(ba|z)?sh\\b\", \"curl | sh\"),\n]\ncmd = (json.load(sys.stdin).get(\"tool_input\") or {}).get(\"command\", \"\")\nfor p, motivo in PATRONES:\n    if re.search(p, cmd, re.I):\n        print(f\"Bloqueado: {motivo}\", file=sys.stderr); sys.exit(2)\n```\n\n`.env`\nMismo patrón, pero mirando `tool_input.file_path` en las herramientas `Read|Edit|Write`\n\ny bloqueando `.env`, `*.pem`, `id_rsa`… (y permitiendo `.env.example`).\n\n`.claude/settings.json`:\n\n```\n{\n  \"hooks\": {\n    \"PreToolUse\": [\n      { \"matcher\": \"Bash\",\n        \"hooks\": [{ \"type\": \"command\", \"command\": \"python3 \\\"$CLAUDE_PROJECT_DIR\\\"/.claude/hooks/bloquear.py\" }] }\n    ]\n  }\n}\n```\n\nReinicia Claude Code y escribe `/hooks` para comprobar que está activo.\n\n```\necho '{\"tool_input\":{\"command\":\"rm -rf ~\"}}' | python3 .claude/hooks/bloquear.py; echo $?   # 2\necho '{\"tool_input\":{\"command\":\"npm test\"}}'  | python3 .claude/hooks/bloquear.py; echo $?   # 0\n```\n\nLos dos hooks probados y una skill de code review en español, gratis: **[https://github.com/carlosp5751258-lgtm/claude-code-es](https://github.com/carlosp5751258-lgtm/claude-code-es)**.\n\nSi quieres la configuración completa (6 skills, comandos `/plan` y `/pr`, plantillas CLAUDE.md, autoformato),\n\nestá el **[Kit Claude Code en Español](https://claudecodees.gumroad.com/l/kit-claude-code-es)**.", "url": "https://wpnews.pro/news/como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos", "canonical_source": "https://dev.to/carlosp5751258lgtm/como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos-2p0l", "published_at": "2026-10-28 20:02:56+00:00", "updated_at": "2026-10-28 20:11:26.718843+00:00", "lang": "en", "topics": ["ai-agents", "ai-tools", "developer-tools", "ai-safety"], "entities": ["Claude Code", "Anthropic", "GitHub", "Gumroad"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos", "markdown": "https://wpnews.pro/news/como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos.md", "text": "https://wpnews.pro/news/como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos.txt", "jsonld": "https://wpnews.pro/news/como-evitar-que-claude-code-borre-tu-proyecto-hooks-de-seguridad-en-5-minutos.jsonld"}}