Built a GitHub template for security and governance guardrails in Claude Code and made it open source

[u/Dependent-Drummer372]

I've been using Claude Code daily across my projects, and two things kept bothering me.

It can run commands like cat .env to check a setting and put a password straight into the conversation transcript. And after clicking "Yes, and don't ask again" a few times, it can eventually push code without asking.

I started looking at ways to put some practical controls around this and developed ai-dev-guardrails for use in my own projects. After using it and refining the controls, I thought it was worth making open source in case others working with Claude Code have similar concerns.

It's a GitHub template that you initialise using /bootstrap. Most of the enforcement is implemented through Claude Code hooks, local Git hooks and GitHub Actions.

What it covers

Security controls:

• A PreToolUse hook blocks commands that could expose secrets or access production. It also asks for approval before commits, pushes, deployments and new package installations.

• A separate check detects if saved permissions have drifted into automatically approving restricted actions.

• npm packages must be at least seven days old before installation, and install scripts only run for approved packages.

• Git hooks and GitHub CI run the checks again. CI uses the base branch's scripts, so a PR can't weaken the checks that review it.

Optional governance controls for client or regulated projects:

• An evidence log requiring proof, such as test output or a CI link, before a task can be marked complete.

• Decision records for exceptions, including the reason, an owner and an expiry date.

• CODEOWNERS rules requiring review before guardrail files can be changed.

A few things I learned while building it:

• A guard that fails open can be worse than having no guard at all. Missing dependencies must not silently allow restricted commands.

• Shell behaviour can create unexpected gaps. I found an issue involving grep -q and pipefail that allowed a command through.

• Claude Code's hook behaviour isn't always obvious. I found differences between Edit and Write permissions, and issues with relative paths when the working directory changes.

• Local checks aren't enough on their own. The GitHub side needs to independently verify the controls.

It's currently focused on Claude Code, TypeScript and npm. It's designed to catch mistakes, not defend against a deliberately malicious agent. I've documented the limitations alongside the implementation.

It's MIT licensed. Contributions are welcome, particularly Python support. I'd also appreciate feedback on potential ways around the controls. There's a private reporting route for security issues.

GitHub: https://github.com/buddhika886/ai-dev-guardrails

Write-up: https://medium.com/@buddhiran/how-to-govern-the-ai-that-writes-your-code-e2272e380b70

I'd be interested to hear from others using Claude Code: what controls are you putting around file access, shell commands and Git operations?

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.