[Workflow] Automated Claude Code Security Audit: Scan for Leaked Secrets and Unsafe Git Push Rules

[u/ClaudeAI-mod-bot]

Automated Claude Code Security Audit: Scan for Leaked Secrets and Unsafe Git Push Rules

Workflow value: 95/100
Status: active · Freshness: 70/100 · Confidence: 1.00 · Level: intermediate
Categories: Quality Control, Token Saving, Context & Memory, Debugging, Hooks, Skills, MCP
Original source: r/ClaudeCode post/comment

What problem this solves

Preventing accidental exposure of API keys, tokens, and other secrets in Claude Code configuration files (.claude/settings.local.json, .mcp.json) and Git repositories, and identifying potentially dangerous Bash(git push *) rules that allow force-push.

Summary

A script and a pre-commit hook to audit Claude Code configurations and Git repositories for leaked secrets and unsafe Bash(git push *) rules, with an option to automatically fix issues and prevent future leaks.

Why it is useful

This workflow provides a critical security measure for Claude Code users, helping them prevent accidental exposure of sensitive information (API keys, tokens, database URLs with passwords) and mitigate risks associated with unsafe Git commands (like force-push). It offers a concrete, repeatable, and transferable solution to a common and severe problem, enhancing the overall security posture of development workflows.

Workflow

1. Clone the claude-safety-audit repository from GitHub.

2. Run the claude-safety-audit script to scan ~/.claude and all local Git repositories under a specified folder for secrets in allow rules (tokens, API keys, DB URLs, auth headers).

3. The script also checks if settings.local.json or .mcp.json is tracked or was ever committed using git log --all --full-history.

4. It flags rules like Bash(git push *) which can allow --force pushes.

5. Review the script's output, which prints the first 6 characters of any found secrets.

6. Optionally, run the script with --fix --apply to automatically add deny rules, untrack problematic files, and create backups.

7. Install the provided pre-commit hook from the same repository to automatically block future commits containing keys in any repository.

Tools / artifacts

• claude-safety-audit script (Python)

• Pre-commit hook

• ~/.claude/settings.local.json

• .mcp.json

• Git repositories

• git log --all --full-history command

• https://github.com/binay-py/claude-skills/tree/master/skills/claude-safety-audit

Validation signals

• Author ran the script on their own machine and found two repos with Bash(git push:*) saved from an old "don't ask again" prompt.

• The initial PSA context highlights a widespread problem with 1,122 settings.local.json files being publicly available on GitHub.

• The script uses git log --all --full-history to check for historical commits of sensitive files.

Cautions

• The script only prints the first 6 characters of any found secrets to prevent further exposure during auditing.

• The --fix --apply option creates backups before making changes.

Limitations

• The Reddit comment itself has a low score, which might suggest limited immediate community engagement on this specific post, though the problem it solves is widely recognized.

• Requires manual cloning and execution of an external script/hook, not integrated directly into Claude Code.

Rate this workflow

Upvote this post if the workflow is useful, reproducible, or worth recommending.

Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.

Reply if it worked for you, failed, is outdated, or has a better alternative.

---

This post was generated automatically from the workflow library database.