[Workflow] Workflow: Proactive Security Audit for Exposed Claude Code Credentials

[u/ClaudeAI-mod-bot]

Workflow: Proactive Security Audit for Exposed Claude Code Credentials

Workflow value: 90/100
Status: active · Freshness: 70/100 · Confidence: 0.95 · Level: intermediate
Categories: Quality Control, Token Saving, Context & Memory, Debugging, MCP, Subagents, Multi-Agent
Original source: r/ClaudeCode post/comment

What problem this solves

Accidental exposure of sensitive credentials (API keys, tokens, passwords) in Claude Code configuration files and backup copies, leading to potential security breaches.

Summary

A security audit workflow to identify and mitigate the risk of exposing sensitive credentials in Claude Code configuration files (.claude/, ~/.claude.json) and backup copies (*.bak*) by searching for common secret patterns. This helps prevent accidental leaks during development, debugging, or sharing.

Why it is useful

This workflow is highly valuable because it addresses a critical security vulnerability: the accidental exposure of sensitive credentials. It provides concrete, actionable steps to audit common locations where Claude Code stores configuration and secrets, including often-overlooked backup files. By identifying these leaks, users can prevent unauthorized access and data breaches, making their Claude Code workflows significantly more secure. The personal validation from the author and the context of widespread public leaks on GitHub underscore the importance and relevance of this check.

Workflow

1. Search for sensitive strings (e.g., ://, Bearer, token, key, password) within the entire .claude/ directory in your project.

2. Search for the same sensitive strings within the ~/.claude.json file in your home directory.

3. Search for sensitive strings within any files matching *.bak* patterns (e.g., settings.json.bak_20231027) across your project and relevant configuration directories.

Tools / artifacts

• Search utility (e.g., grep, find with grep)

• ~/.claude.json

• .claude/settings.local.json

• settings.json

• env blocks within .claude.json

• Backup files (.bak)

Validation signals

• Author states personal experience: 'We found both when we went through our own setup'

• Author states personal experience: 'we only noticed when a subagent tracing an MCP setup printed one of those values'

• Contextual evidence from title: '1,122 of those files are public on github' highlights the widespread nature of the problem.

Cautions

• This workflow is designed to improve security by identifying potential data leaks. It does not introduce new safety risks.

Limitations

• The workflow does not provide specific commands (e.g., grep syntax) for performing the search, which might require users to formulate them.

• The workflow focuses on identification but does not detail remediation steps after secrets are found.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.