Original Reddit post

Yup. My real coding knowledge is cursory and I’m self taught. I thought storing secrets in .env would be enough but after going through this subreddit, its apparently not. Please critique my understanding and ‘fix’ and let me know what I’ve missed out on. Asking another AI for the solution is clearly not the answer. Problem

• It’s a harness behaviour problem, hence writing instructions in claude.md might stop ClaudeCode tool calls and file reads, but not context compaction and other ‘background’ Claude housekeeping tasks.
• the .env itself was first created by Claude Code in the working directory so it registered as a ‘recently touched’ file and was included in the context ingress. Fix

Workflow fix

• Create the .env manually, and in a different folder where I’ve blocked access to, so Glob/Grep sweeps and file restoration can’t reach it. Instructional level
• Revise the Deny Rules in settings.json to deny read/edit/bash (weakest method) { “permissions”: { “deny”: [ “Read( /.env)", “Read( / token .json)”, “Read(~/.secrets/ )”, “Edit( / .env)”, “Write( / .env)”, "Grep( / .env)”, “Bash(cat .env )”, “PowerShell(Get-Content .env )” Application Level
• PreToolUse hook to block Bash/Powershell/Read input mentioning and command variants

.env | token.json | .secrets | variants: type, gc, python -c open(…) OS level

• Sandboxing as an additional safety measure.
• I use a dedicated PC for my ai explorations so that has been my physical ‘sandbox’
• But will attempt actual sandboxing via creating dedicated Limited User Account to not break ongoing projects. Does this cover it? submitted by /u/leftclot

Originally posted by u/leftclot on r/ClaudeCode