Claude Code security checklist
Claude Code works in your terminal: it reads your project, edits files and runs commands. It can move fast across a whole codebase, which makes reviewing what it runs and what it reads part of the job.
These are the agent mistakes we see most, each with a scenario and a habit that prevents it.
Approving commands you have not read
Destructive commands cannot be undone; read the command, not the summary.
Production keys within the agent's reach
An agent running locally uses whatever your local settings point at.
Instructions hidden in content the agent reads
A ticket, issue or web page can carry instructions the agent obeys.
Packages that do not exist
Check every new dependency is real and the one you meant.
A commit that breaks checkout
Read the diff of anything touching payments before it ships.
Keys pasted into the chat
Use environment variables; never paste a secret into a prompt.
Work lost to a force push
Keep force pushes off shared branches.
Run the free checks
Two of the most common leaks take under a minute to check. No sign-up.