AI SECURITYLABS

Security for Claude Code Development: Before your first session

Part 8 of 16

Before your first session

  • Keep it updated: run claude update and claude doctor, because several published vulnerabilities were in the tool itself, not the model.
  • Isolate untrusted code: open unknown repositories in a dev container, VM or cloud session, never on a host that holds your credentials.
  • Use a work account: Team and Enterprise plans include commercial data terms and admin visibility.
  • Don’t run as an administrator: every subprocess Claude spawns inherits your privileges.
  • Start in the project directory, never ~: the launch directory is the write boundary.
  • Install the sandbox dependencies: Linux and WSL2 need bubblewrap and socat. Native Windows has no sandbox, so run Claude Code in WSL2.