Tired of Claude Code Leaking Your Secrets? I Built Guardrails for It

If you use Claude Code a lot, you've probably seen this:

“Let me inspect the configuration.”

And then:

cat .env

Great.

Your database password or API key is now sitting in the conversation.

Claude apologizes.

You rotate the key.

A few sessions later:

grep SOMETHING ~/.pgpass

Same story.

After doing this enough times, I got tired of relying on:

“Claude, please remember not to print secrets.”

So I built claude-code-guardrails.

It's a small open-source set of user-level hooks for Claude Code.

Stop the leak before it happens

The main hook, deny-secrets, intercepts Bash tool calls before execution.

If Claude tries something like:

cat .env

or attempts to expose .pgpass, private keys, credential files, environment variables, or other secret-looking data, the hook can deny the command before Bash runs it.

Conceptually:

Claude Code
    ↓
Bash command
    ↓
PreToolUse hook
    ↓
secret?
    ↓
NOPE.

It's not a security sandbox and it's definitely not 100% protection.

But it stops a surprisingly large class of accidental:

“Oops, I shouldn't have printed that.”

And there's a canary

The second hook is session-heartbeat.

Long Claude Code sessions can gradually lose earlier instructions after context compaction.

The dangerous part is that Claude doesn't suddenly stop working.

It keeps answering.
It keeps sounding confident.
It keeps writing code.

Only the decisions start getting... weird.

So the heartbeat acts as a canary for context degradation.

It injects a timestamp and turn counter into every prompt. If Claude suddenly stops returning the expected marker, that's an early signal that the session may be starting to drift.

Maybe it's time to kill the session and start a fresh one — before Claude starts confidently producing nonsense.

Is it proof that the context is healthy?

No.

It's a canary.

That's the point.

That's basically it

This is not intended to replace proper secret managers, filesystem permissions, gitleaks, trufflehog, or real sandboxing.

It's just a pragmatic extra layer for problems I kept encountering myself.

MIT licensed. Download it, modify it, add your own rules, break it, fix it, send a PR.

Full documentation and installation instructions are on GitHub:

https://github.com/ineron/claude-code-guardrails

Sometimes AI coding agents don't need another prompt.

They need a fence.

And maybe a canary.