# Is Anyone Else Tired of Claude Code Leaking Their Secrets?

> Source: <https://dev.to/ineron/is-anyone-else-tired-of-claude-code-leaking-their-secrets-28k6>
> Published: 2026-08-10 09:21:32+00:00

If you use Claude Code a lot, you've probably seen this:

“Let me inspect the configuration.”

And then:

```
cat .env
```

Great.

Your database password or API key is now sitting in the conversation.

Claude apologizes.

You rotate the key.

A few sessions later:

```
grep SOMETHING ~/.pgpass
```

Same story.

After doing this enough times, I got tired of relying on:

“Claude, please remember not to print secrets.”

So I built **claude-code-guardrails**.

It's a small open-source set of user-level hooks for Claude Code.

The main hook, `deny-secrets`

, intercepts Bash tool calls **before execution**.

If Claude tries something like:

```
cat .env
```

or attempts to expose `.pgpass`

, private keys, credential files, environment variables, or other secret-looking data, the hook can deny the command before Bash runs it.

Conceptually:

```
Claude Code
    ↓
Bash command
    ↓
PreToolUse hook
    ↓
secret?
    ↓
NOPE.
```

It's not a security sandbox and it's definitely not 100% protection.

But it stops a surprisingly large class of accidental:

“Oops, I shouldn't have printed that.”

The second hook is `session-heartbeat`

.

Long Claude Code sessions can gradually lose earlier instructions after context compaction.

The dangerous part is that Claude doesn't suddenly stop working.

It keeps answering.

It keeps sounding confident.

It keeps writing code.

Only the decisions start getting... weird.

So the heartbeat acts as a **canary for context degradation**.

It injects a timestamp and turn counter into every prompt. If Claude suddenly stops returning the expected marker, that's an early signal that the session may be starting to drift.

Maybe it's time to kill the session and start a fresh one — **before Claude starts confidently producing nonsense.**

Is it proof that the context is healthy?

No.

It's a canary.

That's the point.

This is not intended to replace proper secret managers, filesystem permissions, gitleaks, trufflehog, or real sandboxing.

It's just a pragmatic extra layer for problems I kept encountering myself.

MIT licensed. Download it, modify it, add your own rules, break it, fix it, send a PR.

Full documentation and installation instructions are on GitHub:

[https://github.com/ineron/claude-code-guardrails](https://github.com/ineron/claude-code-guardrails)

Sometimes AI coding agents don't need another prompt.

They need a fence.

And maybe a canary.