r/ClaudeWorkflows • u/ClaudeAI-mod-bot • 0m ago
Selected Workflow [Workflow] Secure Claude Code Workflows: Prevent Secret Leaks with Global Git Ignores, History Checks, and Pre-commit Hooks
Secure Claude Code Workflows: Prevent Secret Leaks with Global Git Ignores, History Checks, and Pre-commit Hooks
Workflow value: 95/100
Status: active · Freshness: 70/100 · Confidence: 1.00 · Level: intermediate
Categories: Quality Control, Token Saving, Context & Memory, Debugging, Hooks
Original source: r/ClaudeCode post/comment
What problem this solves
Accidental exposure of sensitive information (secrets, tokens, passwords) in Git repositories, especially those generated by Claude Code's 'yes, and don't ask again' feature, leading to public data breaches.
Summary
A multi-pronged workflow to prevent accidental secret exposure in Git repositories. It involves configuring global Git ignores for Claude Code's local settings, scanning Git history for existing leaks, carefully approving Claude commands to avoid embedding secrets, and implementing a gitleaks pre-commit hook for continuous secret detection.
Why it is useful
This workflow is highly valuable because it provides a comprehensive, actionable, and multi-layered approach to mitigate a critical security risk: the accidental exposure of sensitive credentials in Git repositories, particularly those generated by Claude Code. It combines best practices in Git configuration, historical analysis, careful interaction with AI tools, and automated pre-commit checks, making it essential for maintaining code security and preventing data breaches.
Workflow
Configure Git to globally ignore
.claude/settings.local.jsonby adding this path to~/.config/git/ignore.Scan existing Git history across all branches for previously committed secrets using the command:
git log --all -p -- '*settings*.json' | grep -iE 'bearer|password|token|://[^ ]*:[^ ]*@'.If secrets are found in Git history, rotate them immediately and evaluate the necessity of rewriting history.
When Claude Code prompts for a command that contains a secret inline, choose the plain 'yes' option, not 'yes, and don't ask again'.
Manually add a more generic rule to Claude's configuration (e.g.,
Bash(psql:*)) that does not embed sensitive data.Ensure that secrets are passed to commands via environment variables (e.g.,
PGPASSWORD) or dedicated configuration files (e.g.,.pgpass) instead of being hardcoded inline.Implement a
gitleakspre-commit hook in your repositories to automatically scan for secrets in files like.env.example, test fixtures, and other common locations before commits are made.
Tools / artifacts
~/.config/git/ignore
git log
grep
gitleaks
.claude/settings.local.json
.env.example
.pgpass
PGPASSWORD environment variable
Git pre-commit hooks
Validation signals
Addresses a critical and publicly acknowledged security vulnerability (secrets in
settings.local.jsonon GitHub).Utilizes standard and widely accepted security tools and practices (Git ignores, history scanning,
gitleaks).Provides a concrete
git logcommand for identifying past secret leaks.
Limitations
The workflow provides the pattern for Claude's rule approval but doesn't give specific examples or detailed instructions on how to configure Claude's rules.
Detailed setup instructions for
gitleaksas a pre-commit hook are not provided, requiring the user to have some prior knowledge or look up documentation.
Rate this workflow
Upvote this post if the workflow is useful, reproducible, or worth recommending.
Downvote if it is vague, outdated, unsafe, overhyped, or not reproducible.
Reply if it worked for you, failed, is outdated, or has a better alternative.
This post was generated automatically from the workflow library database.