{"slug": "is-anyone-else-tired-of-claude-code-leaking-their-secrets", "title": "Is Anyone Else Tired of Claude Code Leaking Their Secrets?", "summary": "A developer has released claude-code-guardrails, an open-source set of user-level hooks for Claude Code that intercepts Bash tool calls before execution to deny commands that might expose secrets like .env files or private keys. The tool also includes a session-heartbeat hook that acts as a canary for context degradation, injecting a timestamp and turn counter into prompts to signal when a session may be drifting. The project is available on GitHub under an MIT license.", "body_md": "If you use Claude Code a lot, you've probably seen this:\n\n“Let me inspect the configuration.”\n\nAnd then:\n\n```\ncat .env\n```\n\nGreat.\n\nYour database password or API key is now sitting in the conversation.\n\nClaude apologizes.\n\nYou rotate the key.\n\nA few sessions later:\n\n```\ngrep SOMETHING ~/.pgpass\n```\n\nSame story.\n\nAfter doing this enough times, I got tired of relying on:\n\n“Claude, please remember not to print secrets.”\n\nSo I built **claude-code-guardrails**.\n\nIt's a small open-source set of user-level hooks for Claude Code.\n\nThe main hook, `deny-secrets`\n\n, intercepts Bash tool calls **before execution**.\n\nIf Claude tries something like:\n\n```\ncat .env\n```\n\nor attempts to expose `.pgpass`\n\n, private keys, credential files, environment variables, or other secret-looking data, the hook can deny the command before Bash runs it.\n\nConceptually:\n\n```\nClaude Code\n    ↓\nBash command\n    ↓\nPreToolUse hook\n    ↓\nsecret?\n    ↓\nNOPE.\n```\n\nIt's not a security sandbox and it's definitely not 100% protection.\n\nBut it stops a surprisingly large class of accidental:\n\n“Oops, I shouldn't have printed that.”\n\nThe second hook is `session-heartbeat`\n\n.\n\nLong Claude Code sessions can gradually lose earlier instructions after context compaction.\n\nThe dangerous part is that Claude doesn't suddenly stop working.\n\nIt keeps answering.\n\nIt keeps sounding confident.\n\nIt keeps writing code.\n\nOnly the decisions start getting... weird.\n\nSo the heartbeat acts as a **canary for context degradation**.\n\nIt injects a timestamp and turn counter into every prompt. If Claude suddenly stops returning the expected marker, that's an early signal that the session may be starting to drift.\n\nMaybe it's time to kill the session and start a fresh one — **before Claude starts confidently producing nonsense.**\n\nIs it proof that the context is healthy?\n\nNo.\n\nIt's a canary.\n\nThat's the point.\n\nThis is not intended to replace proper secret managers, filesystem permissions, gitleaks, trufflehog, or real sandboxing.\n\nIt's just a pragmatic extra layer for problems I kept encountering myself.\n\nMIT licensed. Download it, modify it, add your own rules, break it, fix it, send a PR.\n\nFull documentation and installation instructions are on GitHub:\n\n[https://github.com/ineron/claude-code-guardrails](https://github.com/ineron/claude-code-guardrails)\n\nSometimes AI coding agents don't need another prompt.\n\nThey need a fence.\n\nAnd maybe a canary.", "url": "https://wpnews.pro/news/is-anyone-else-tired-of-claude-code-leaking-their-secrets", "canonical_source": "https://dev.to/ineron/is-anyone-else-tired-of-claude-code-leaking-their-secrets-28k6", "published_at": "2026-08-10 09:21:32+00:00", "updated_at": "2026-08-10 09:49:21.558194+00:00", "lang": "en", "topics": ["ai-tools", "developer-tools", "ai-safety"], "entities": ["Claude Code", "claude-code-guardrails", "GitHub", "ineron"], "alternates": {"html": "https://wpnews.pro/news/is-anyone-else-tired-of-claude-code-leaking-their-secrets", "markdown": "https://wpnews.pro/news/is-anyone-else-tired-of-claude-code-leaking-their-secrets.md", "text": "https://wpnews.pro/news/is-anyone-else-tired-of-claude-code-leaking-their-secrets.txt", "jsonld": "https://wpnews.pro/news/is-anyone-else-tired-of-claude-code-leaking-their-secrets.jsonld"}}