Developer Security Action Checklist for Claude Code

Claude Code Configuration & Permissions

[ ]

Review .claude/settings.json and explicitly define allowed, restricted, and confirmation-required operations. [ ]

Deny access to .env files, private keys, credentials, and sensitive configuration files wherever supported. [ ] Require human approval for destructive commands, privileged operations, and production changes. [ ] Review CLAUDE.md and project rules for secure coding requirements. [ ] Verify permission behavior with negative tests; do not assume configuration patterns block every attack path.

Secrets & Sensitive Data

[ ] Store secrets in an approved secrets manager or protected CI/CD variables. [ ] Add .env, private keys, certificates, and local settings to .gitignore where appropriate. [ ] Commit .env.example with placeholder values only. [ ] Run secret scanning before commits and in CI. [ ] Rotate any credential exposed in source control, logs, prompts, or tool output.

MCP Servers & External Tools

[ ] Review each MCP server's source, permissions, dependencies, and required network access. [ ] Connect only trusted servers and enable only the tools needed for the task. [ ] Avoid passing secrets or sensitive repository data to unapproved external services. [ ] Treat retrieved files, web content, and tool output as untrusted input. [ ] Test for prompt injection and unintended tool execution.

Secure Coding & Code Review

[ ] Validate and sanitize untrusted input at application boundaries. [ ] Use parameterized database queries and context-aware output encoding. [ ] Check authentication, authorization, and tenant isolation. [ ] Add tests for security-sensitive changes and relevant abuse cases. [ ] Manually review AI-generated changes involving authentication, cryptography, permissions, and data handling.

Dependencies & Supply Chain

[ ] Use lockfiles and reproducible dependency installation. [ ] Scan dependencies for known vulnerabilities and review transitive packages. [ ] Pin CI/CD actions and critical tooling to verified versions or immutable references. [ ] Avoid installing packages or running scripts suggested by untrusted content without review. [ ] Establish a documented process for triaging and remediating security findings.

CI/CD & Repository Protection

[ ] Run tests, linting, SAST, secret scanning, and dependency checks on pull requests. [ ] Set minimal workflow permissions, such as contents: read when sufficient. [ ] Protect the main branch with required status checks and reviewed pull requests. [ ] Restrict deployment credentials to trusted workflows and environments. [ ] Require explicit approval for production deployment and privileged changes.

Runtime Isolation & Monitoring

[ ] Run Claude-assisted tasks in a controlled environment with limited filesystem and network access. [ ] Avoid mounting production credentials, SSH agents, or sensitive host directories into containers. [ ] Keep development, testing, staging, and production credentials separate. [ ] Audit relevant tool execution, permission changes, and CI/CD events without logging secrets. [ ] Patch Claude Code, MCP servers, dependencies, and development tooling regularly.

Final Release Gate

[ ] No unresolved critical or high-severity findings without an approved exception. [ ] No exposed secrets or unauthorized permissions. [ ] Security tests and required CI checks pass. [ ] Security-sensitive changes receive human review. [ ] Rollback and incident-response procedures are available.

Definition of done:

A change is ready to merge only when required security checks pass, access is appropriately restricted, and the responsible reviewer accepts the remaining risk.

Core principle:

Let Claude propose and implement changes; enforce security through independent controls, automated validation, isolation, and accountable human approval.

Recommended implementation order:

Start with secret protection and least-privilege permissions, then enforce CI security gates, review MCP integrations, and strengthen runtime isolation. These controls address some of the most consequential risks in AI-assisted development.