Is Claude Code safe?
Used with its defaults, on code you trust, yes: it asks before it edits files or runs commands. The risk grows with every prompt you stop reading. Most incidents come from one of four things:
- A destructive command you approved without looking, or that ran because prompts were turned off:
rm -rfon the wrong path,git reset --hard,git clean -fd, a dropped database. - Secrets read into the conversation. Once an agent runs
cat .envor prints the environment, those values are sent to the model and saved in a transcript on disk. - Prompt injection. Instructions hidden in a web page, an issue, a README or a dependency can steer the agent, usually towards uploading something.
- Too much trust in tools: MCP servers and hooks run with your permissions.
What Claude Code gives you
Permission prompts and rules
By default Claude Code asks before edits and shell commands. Rules in settings.json let you allow, ask about or deny specific tools, commands and paths, and deny rules win. See the permissions guide.
The sandbox
The /sandbox command runs shell commands inside an operating-system sandbox (Seatbelt on macOS) that limits which files they can write and which hosts they can reach. See the sandbox guide.
Hooks
A PreToolUse hook is your own program, run before every tool call, that can block it. It's the most flexible control and the only one that can inspect a command's content. See the hooks guide.
Checkpoints
Claude Code saves the state of files before it edits them, and /rewind brings them back. See the undo guide for what that does and doesn't cover.
The gaps
| Gap | Why it's there |
|---|---|
| Deny rules for files don't stop shell commands | A rule such as Read(./.env) applies to Claude's file tools. A shell command that reads the same file is a different tool call, unless the sandbox is on and configured to block it. |
| Environment variables | Anything exported in the shell you started Claude Code from is visible to every command it runs. |
| Checkpoints don't cover shell commands | Files deleted or changed by rm, mv, a build script or a migration aren't tracked, so /rewind can't restore them. |
| Transcripts keep everything | Every tool result is written to ~/.claude/projects in plain text, including any secret that was printed. |
| Bypass mode removes the prompts | --dangerously-skip-permissions turns off the main safety net. See the YOLO mode guide. |
A checklist
- Keep production credentials off your development machine. Give agents test keys with limited scope.
- Add deny rules for secret files and for commands you never want run.
- Turn on the sandbox for unattended work, and limit network access to the hosts you need.
- Add a
PreToolUsehook that blocks secret reads and environment dumps in shell commands. - Commit before you start a session, and have a copy of the project that doesn't depend on git.
- Only install MCP servers and plugins you'd be willing to run as a normal program.
- Check your transcripts for keys from time to time, and rotate any you find.
Where Rollcage fits
Rollcage is a Mac menu-bar app that does items 4, 5 and 7 for you, and for Codex, Cursor and Gemini CLI at the same time:
- The Guard installs a ready-made hook that blocks secret-file reads, environment dumps and destructive commands, including through the shell.
- Snapshots copy the whole project when Claude Code starts and every 15 minutes, so anything a shell command deleted can be restored.
- The secrets leak scan finds keys already sitting in transcripts and overwrites them.
- The network guard blocks uploads to paste, file-drop and tunnel sites.
Rollcage is a guardrail, not a sandbox. Its hook sees the tool calls an agent makes, not what happens inside a program the agent writes and then runs. Use it together with the steps above, not instead of them.
Questions
Can Claude Code read my .env file?
Yes, unless you stop it. It can open the file with its Read tool or with a shell command such as cat. A deny rule covers the first route. The second needs the sandbox or a hook that inspects shell commands.
Does Claude Code send my code to Anthropic?
The files it reads and the output of the commands it runs are sent to the model as part of the conversation. That's how it works. How long that data is kept and whether it's used for training depends on your plan and settings, so check Anthropic's current privacy documentation for your account type.
Can Claude Code delete my files?
Yes. It can run rm and any other command you can. By default it asks first. With prompts skipped, nothing stands between a wrong path and your files except a hook, a sandbox or a snapshot.
Is it safe to run Claude Code with --dangerously-skip-permissions?
Only where a mistake is cheap: a container, a virtual machine, or a project with a snapshot and no real credentials within reach.