Safety hooks
Block destructive commands, protect secrets, and keep writes inside the repo.
Block commits that contain secrets
Intercepts git commit commands and runs gitleaks on staged changes first.
PreToolUseBashblocking riskneeds manual checkBlock destructive shell commands
Blocks rm -rf, disk tools, force pushes, and destructive git commands before they run.
PreToolUseBashblocking riskneeds manual checkBlock writes outside the repo
Stops Edit/Write calls whose target path resolves outside the project root.
PreToolUseEdit|Writeblocking riskneeds manual checkProtect .env and secret files
Blocks Claude from writing to .env files, keys, and credential files - unless you say otherwise.
PreToolUseEdit|Writeblocking riskneeds manual checkSecret scan on changed files
Runs gitleaks on every file Claude edits and warns when something looks like a secret.
PostToolUseEdit|Writereview riskneeds manual check