yodaisgaming/claude-code-cred-guard

claude-code-cred-guard is a safety hook for Claude Code, an AI coding agent, that stops the agent from reading credential files, such as passwords or API keys stored in a dot env file, directly into its conversation. The problem it solves is that once a secret's plaintext is read into the conversation, it gets sent to the AI model's provider and saved in local session logs, which is a privacy and security risk even if the agent means no harm. The tool works as a single JavaScript file with no external dependencies, plugged into Claude Code's PreToolUse hook system, which lets it inspect a command before it runs and block it if needed. Its key design choice is checking whether a credential file is actually the target being read, rather than simply checking whether the filename appears anywhere in the command. This avoids two common failure modes seen in simpler versions of this idea: blocking harmless commands that merely mention a credential filename, such as a search pattern or a note, and missing sneaky reads such as a Python one liner that opens the file or a command run inside another interpreter. By default it recognizes many common credential file types, including dot env files, WordPress config files, SSH private keys, cloud credential files for AWS and Kubernetes, and certificate files, along with commands that dump the whole environment variable list at once. It deliberately allows reading a single named environment variable and allows scripts that consume credentials internally without printing them out. The author is explicit that this tool defends against accidental exposure by a well meaning agent, not a determined attacker trying to hide a read, which would need different defenses like sandboxing. Installing it means copying one JavaScript file to a stable location and registering it in a Claude Code settings file, matching it against the Bash, Read, and Grep tools, using an absolute file path since a shortcut like a tilde is not expanded inside the hook command. It requires Node.js 18 or later and is tested on Linux, macOS, and Windows. If the hook itself ever fails, it is designed to allow the command through rather than block the agent entirely.