Security Guide

Claude Code is built with security at its core. This guide covers security mechanisms and best practices.

Security Mechanisms

Permission-Based Architecture

Claude Code uses strict read-only permissions by default. Additional actions (editing files, running tests, executing commands) require explicit authorization.

• One-time approval: Allow current operation only
• Session approval: Auto-allow for this session
• Permanent approval: Add to allowlist

Built-in Protections

Prompt Injection Protection

Core Protections

• Permission system: Sensitive operations require explicit approval
• Context-aware analysis: Detect harmful instructions by analyzing full request
• Input sanitization: Process user inputs to prevent command injection
• Command blocklist: Block commands that fetch arbitrary web content

Additional Safeguards

• Network requests require user approval by default
• Web fetch uses isolated context window
• Suspicious bash commands require manual approval
• Complex commands include natural language explanations

Handling Sensitive Code

Exclude Sensitive Files

Configure in .claude/settings.json:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(./config/credentials.json)"
    ]
  }
}

Files matching these patterns are completely invisible to Claude Code.

Use Sandboxing

Enable sandbox to isolate bash commands:

/sandbox

Or in configuration:

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true
  }
}

Team Security

Managed Settings

IT admins can deploy organization-wide policies:

// /Library/Application Support/ClaudeCode/managed-settings.json
{
  "permissions": {
    "deny": [
      "Bash(rm -rf:*)",
      "Read(/etc/passwd)"
    ],
    "disableBypassPermissionsMode": "disable"
  },
  "allowManagedHooksOnly": true
}

Share Permission Configurations

Share approved configurations through version control:

// .claude/settings.json (committed to git)
{
  "permissions": {
    "allow": [
      "Bash(npm run:*)",
      "Bash(git diff:*)"
    ]
  }
}

MCP Server Security

• Use MCP servers you trust or write your own
• Configure Claude Code permissions for MCP servers
• Anthropic does not manage or audit any MCP servers

IDE Security

With auto-accept enabled in VS Code:

• Claude may modify IDE config files (like settings.json)
• These files may be auto-executed by VS Code

Recommendations:

• Enable Restricted Mode for untrusted code
• Use manual approval instead of auto-accept
• Review changes carefully before accepting

Best Practices

Working with Untrusted Content

1. Review suggested commands before approval
2. Avoid piping untrusted content directly to Claude
3. Verify changes to critical files
4. Use VMs to run scripts and tool calls
5. Report suspicious behavior with /bug

Credential Management

• API keys and tokens are encrypted
• Use secure secrets management for sensitive info
• Never hardcode passwords in config files

Regular Audits

/permissions

View and manage current permission configuration.

Reporting Security Issues

If you discover a Claude Code security vulnerability:

1. Do not disclose publicly
2. Report through Anthropic’s official vulnerability disclosure channel (see Trust Center)
3. Include detailed reproduction steps
4. Allow time for resolution before public disclosure

Related Resources

• Anthropic Trust Center - Security certifications
• Settings Reference - Permission configuration
• Hooks System - Automate security checks