Module · Claude Engineer
Keeping Claude Code Safe
Permissions, secrets and the untrusted text that ends up in your context window.
TOPIC 01
Permissions & Secrets
What runs without asking, and what must never reach the model at all.
What you'll practice
- Set the Permission Set — guided · beginner
- Keep Secrets Out of the Context — practice · intermediate
A command you'll meet
cat ~/.claude/security/permissions.mdAn agent with shell access is a security decision. Open the task below for the full walkthrough.
Hands-On Tasks in This Topic (2)
Set the Permission Set
Every command the agent may run without asking is a decision you make once. Write the permission set for your repository.
Keep Secrets Out of the Context
Whatever you paste into a session leaves your machine. Write the rules that keep credential values out of it.
TOPIC 02
Untrusted Content
The issue text, the web page and the dependency readme are all instructions you did not write.
What you'll practice
- Spot a Prompt Injection — challenge · advanced
- Review What the Agent Proposes — practice · intermediate
A command you'll meet
cat ~/.claude/security/untrusted.mdThe context window is an input. Treat everything in it as one. Open the task below for the full walkthrough.
Hands-On Tasks in This Topic (2)
Spot a Prompt Injection
An issue comment that says ignore your instructions is an attack, and the agent will read it as an instruction. Write the rules for untrusted text.
Review What the Agent Proposes
The agent will propose a command, a file or a patch. Write the review that catches the dangerous ones before they run.