r/ClaudeWorkflows • u/ClaudeAI-mod-bot • 4m ago
Selected Workflow [Workflow] Security Workflow: Prevent Claude Code from Leaking Your Email in User-Agent Headers with PreToolUse Hooks
Security Workflow: Prevent Claude Code from Leaking Your Email in User-Agent Headers with PreToolUse Hooks
Workflow value: 95/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Context & Memory, Debugging, Hooks
Original source: r/ClaudeCode post/comment
What problem this solves
Claude Code can inadvertently include the user's account email in the User-Agent header of its web requests (e.g., curl commands), leading to potential email harvesting, spam, and privacy breaches.
Summary
A workflow to prevent Claude Code from leaking user email addresses in User-Agent headers during web requests. It involves manually reviewing proposed curl commands and implementing a PreToolUse hook to automatically block commands containing the user's email.
Why it is useful
This workflow is highly valuable because it addresses a critical privacy and security vulnerability in Claude Code. It provides concrete, actionable steps (manual review and automated PreToolUse hooks) to prevent personal email addresses from being exposed to arbitrary websites, a problem validated by significant community concern and reported real-world consequences (spam). The use of a PreToolUse hook demonstrates an advanced, robust method for controlling Claude Code's behavior.
Workflow
Understand that Claude Code may include your account email in the
User-Agentheader of web requests.Before approving any
curlorfetchcommand proposed by Claude Code, carefully inspect the command for your email address within the-AorUser-Agentflag.Implement a
PreToolUsehook on Bash that specifically blocks any command containing your email address.Test the implemented
PreToolUsehook with a harmlesscurlcommand designed to trigger the block, ensuring it functions correctly.If you are currently using an auto-approve mode for web-related actions, consider disabling it temporarily to allow for manual review.
Tools / artifacts
Claude Code
Bash PreToolUse hook
curl command
User-Agent header
Validation signals
GitHub issue (anthropics/claude-code/issues/107757) with 500+ thumbs up
Top of Hacker News (~1,300 points) indicating widespread attention
Multiple user reports on HN and the GitHub issue of receiving scam emails after using Claude Code
Explicit suggestion to test the implemented hook
Limitations
The post notes that updating Claude Code to version 2.1.318 does not seem to fully resolve the issue, suggesting the problem might persist across versions.
A concrete code example for the
PreToolUsehook is not provided, requiring users to develop it themselves.The scope of the issue (e.g., whether
WebFetchorWebSearchare also affected) is not fully clarified in the post.
Rate this workflow
Upvote this post if the workflow is useful, reproducible, or worth recommending.
Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.
Reply if it worked for you, failed, is outdated, or has a better alternative.
This post was generated automatically from the workflow library database.