// 37 tips tagged "security"
The /security-review command scans your uncommitted changes for injection vectors, auth gaps, hardcoded secrets, and other common vulnerabilities.
Claude Code checks credentials in a specific order. A stale ANTHROPIC_API_KEY in your shell can shadow your subscription login without any obvious error.
The otelHeadersHelper setting runs a script to generate fresh authentication headers for your OTel backend, refreshing automatically every 29 minutes.
Claude Code exports detailed events via OpenTelemetry logs, giving you a full audit trail of every tool call, API request, and user prompt.
Use prompt hooks to evaluate tool calls with an LLM instead of bash scripts, describing your safety policies in plain English rather than brittle regex patterns.
Route Claude Code's permission prompts to a custom MCP tool in CI, so automated runs get programmatic approval instead of blanket allow-all or fail-on-prompt.
Define exactly which built-in tools Claude can access in a session, from full capabilities down to read-only or even no tools at all.
Add deny rules to your project settings to prevent Claude Code from reading .env files, credentials, and other sensitive paths.
Enable sandbox mode to let Claude run bash commands freely within controlled filesystem and network boundaries.
Point Claude Code at a script that returns a fresh API key from your vault, so you never hardcode credentials again.
Use --strict-mcp-config to restrict Claude Code to only the MCP servers you explicitly provide, ignoring all other sources.
Remove tools entirely from Claude's context with --disallowedTools to enforce hard constraints like read-only analysis.