If you use Claude Code a lot, you've probably seen this:
“Let me inspect the configuration.”
And then:
cat .env
Great.
Your database password or API key is now sitting in the conversation.
Claude apologizes.
You rotate the key.
A few sessions later:
grep SOMETHING ~/.pgpass
Same story.
After doing this enough times, I got tired of relying on:
“Claude, please remember not to print secrets.”
So I built claude-code-guardrails.
It's a small open-source set of user-level hooks for Claude Code.
The main hook, deny-secrets
, intercepts Bash tool calls before execution.
If Claude tries something like:
cat .env
or attempts to expose .pgpass
, private keys, credential files, environment variables, or other secret-looking data, the hook can deny the command before Bash runs it.
Conceptually:
Claude Code
↓
Bash command
↓
PreToolUse hook
↓
secret?
↓
NOPE.
It's not a security sandbox and it's definitely not 100% protection.
But it stops a surprisingly large class of accidental:
“Oops, I shouldn't have printed that.”
The second hook is session-heartbeat
.
Long Claude Code sessions can gradually lose earlier instructions after context compaction.
The dangerous part is that Claude doesn't suddenly stop working.
It keeps answering.
It keeps sounding confident.
It keeps writing code.
Only the decisions start getting... weird.
So the heartbeat acts as a canary for context degradation.
It injects a timestamp and turn counter into every prompt. If Claude suddenly stops returning the expected marker, that's an early signal that the session may be starting to drift.
Maybe it's time to kill the session and start a fresh one — before Claude starts confidently producing nonsense.
Is it proof that the context is healthy?
No.
It's a canary.
That's the point.
This is not intended to replace proper secret managers, filesystem permissions, gitleaks, trufflehog, or real sandboxing.
It's just a pragmatic extra layer for problems I kept encountering myself.
MIT licensed. Download it, modify it, add your own rules, break it, fix it, send a PR.
Full documentation and installation instructions are on GitHub:
https://github.com/ineron/claude-code-guardrails
Sometimes AI coding agents don't need another prompt.
They need a fence.
And maybe a canary.