How to use it
- Once at setup, work through sections A to H.
- Fix every P1 item before doing any work on company code. P2 items close important gaps; P3 items are good practice.
- Items with an audit check ID are verified automatically by the Claude Code Security Audit. Re-run it monthly and after every Claude Code upgrade. Items without one are confirmed by hand.
- Keep the completed checklist with your saved audit report as your assessment record.
A. Installation and identity
| # | Check | Priority | Audit check |
|---|---|---|---|
| A1 | Claude Code is installed and at or above your organisation’s minimum version. | P1 | I01 |
| A2 | claude doctor reports no warnings. | P2 | manual |
| A3 | Work code uses a Team, Enterprise or company-provided account, never a personal consumer account. | P1 | manual |
| A4 | /status shows your organisation’s managed settings as a settings source (enterprise users). | P2 | manual |
| A5 | Tokens are stored in the OS keychain or a user-only file, not a world-readable one. | P2 | manual |
B. Permission rules (~/.claude/settings.json)
| # | Check | Priority | Audit check |
|---|---|---|---|
| B1 | A user settings file exists and follows a hardened baseline. | P1 | U01 |
| B2 | Read deny rules cover .env, .env.*, secrets/, ~/.ssh, ~/.aws and cloud CLI credential folders. | P1 | U06, U07 |
| B3 | curl and wget are denied, or at least require approval. | P2 | U08 |
| B4 | git push, terraform, kubectl, npm publish and similar commands require approval. | P2 | U10 |
| B5 | No over-broad allow rules such as Bash, Bash(*), Bash(rm …), Bash(sudo …) or WebFetch. | P1 | U09 |
| B6 | The default permission mode is Manual, Plan, acceptEdits or Auto, never bypass. | P1 | U13 |
| B7 | Bypass mode is disabled by organisation policy (permissions.disableBypassPermissionsMode: "disable" in managed settings). | P3 | manual |
| B8 | --dangerously-skip-permissions is never used outside a disposable, network-restricted container, and no alias or wrapper adds it. | P1 | R01 |
C. Sandbox
| # | Check | Priority | Audit check |
|---|---|---|---|
| C1 | The sandbox is enabled (/sandbox or sandbox.enabled: true); on Linux and WSL2, bubblewrap and socat are installed. | P1 | U02 |
| C2 | Strict sandbox mode: allowUnsandboxedCommands: false. | P2 | U03 |
| C3 | The network allowlist holds only the registries and hosts you need, with no *, github.com, paste or webhook sites. | P2 | U05 |
| C4 | Unlisted hosts are denied rather than prompted (strictAllowlist). | P3 | U04 |
| C5 | sandbox.credentials.files denies or masks ~/.aws, ~/.ssh and other credential files. | P1 | U06 |
| C6 | Secret environment variables are denied or masked for sandboxed commands, or CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set. | P2 | manual |
| C7 | No sandbox-weakening settings: no docker.sock in allowUnixSockets, and no enableWeakerNestedSandbox, allowAppleEvents, enableWeakerNetworkIsolation or filesystem.disabled. | P1 | U16 (Docker socket) |
| C8 | Windows: Claude Code runs inside WSL2 or a dev container, since native Windows has no sandbox. | P1 | U02 |
| C9 | Windows: the WebDAV (WebClient) service is off, and Claude Code is never allowed \\* paths. | P1 | manual |
D. Working habits
| # | Check | Priority | Audit check |
|---|---|---|---|
| D1 | Sessions start in the project directory, never in ~. | P1 | manual |
| D2 | Unknown repositories, forks, contractor code and pentest targets are opened only in a dev container, VM or cloud session. | P1 | manual |
| D3 | Every command is read before approval, especially unsandboxed ones, network commands, git push, package installs, and anything touching .claude/, .mcp.json, CI files or shell startup files. | P1 | manual |
| D4 | Issue, pull request and web content is read by a person before Claude acts on it; instruction-like text in files is treated as suspicious. | P2 | manual |
| D5 | Secrets, customer data and regulated data are never pasted into prompts. | P1 | manual |
| D6 | No secret tokens (ANTHROPIC_API_KEY, GITHUB_TOKEN, AWS_*…) are exported in the everyday shell. | P2 | manual |
| D7 | Plan mode is used for large refactors and unfamiliar code. | P3 | manual |
| D8 | Parallel agent sessions use git worktrees so changes stay reviewable. | P3 | manual |
E. Extensions: MCP servers, plugins, skills and hooks
| # | Check | Priority | Audit check |
|---|---|---|---|
| E1 | Every MCP server is company-approved (or written in-house), pinned to a version, and has minimal OAuth scopes. | P1 | M01, P04, P05 |
| E2 | Every plugin comes from an approved marketplace, and its hooks, MCP servers and executables were reviewed. | P1 | U17, P13 |
| E3 | You know what every configured hook does; no HTTP hook points to an unknown URL. | P2 | P03 |
| E4 | Guardrail PreToolUse hooks block edits to .claude/, CI workflows and lockfiles, and dangerous commands. | P3 | H01, H02, H03 |
| E5 | MCP servers, plugins and skills no longer in use are removed. | P3 | manual |
F. Repository-level configuration
| # | Check | Priority | Audit check |
|---|---|---|---|
| F1 | Before trusting a cloned repository, .claude/settings.json, .claude/settings.local.json, .claude/hooks/, .mcp.json, CLAUDE.md and symlinks are reviewed. List symlinks with find . -type l -not -path './.git/*' -not -path './node_modules/*' -exec ls -l {} \; | P1 | P03, P09, P10, P11 |
| F2 | Project settings define no hooks, over-broad allow rules, bypass mode or sandbox exclusions you didn’t approve. | P1 | P02, P03, P09 |
| F3 | .env files are gitignored and covered by Read deny rules. | P2 | P08, U07 |
| F4 | CLAUDE.md and .claude/** are protected by CODEOWNERS in team repositories. | P3 | manual |
G. Code security gates
| # | Check | Priority | Audit check |
|---|---|---|---|
| G1 | /security-review runs before every pull request. | P2 | manual |
| G2 | The security-guidance plugin (or an equivalent) is installed so Claude reviews its own changes. | P3 | manual |
| G3 | Secret scanning, SAST and SCA run on every pull request and are never bypassed. | P1 | manual |
| G4 | Claude never merges its own pull requests; a person reviews every AI-authored change. | P1 | manual |
| G5 | Every package Claude adds is checked to exist and be the intended one (typosquats, hallucinated packages). | P2 | manual |
H. Endpoint and reporting
| # | Check | Priority | Audit check |
|---|---|---|---|
| H1 | Full-disk encryption is on (FileVault or BitLocker). | P2 | manual |
| H2 | Company EDR is installed on the host, and inside WSL and dev containers where required. | P2 | manual |
| H3 | OpenTelemetry export is enabled as your organisation’s policy requires. | P3 | manual |
| H4 | Suspicious agent behaviour is reported the same day, with /feedback and to the security team. | P1 | manual |
| H5 | Claude Code is updated weekly, and immediately when a security advisory is published. | P1 | I01 |
Sources
- Claude Code documentation: Security (including the Windows WebDAV warning), Sandboxing, Permissions, Settings reference.
- Repository-borne attacks behind section F: see the Security for Claude Code Development post.
Informational only, with no guarantee of a vulnerability-free setup, so test every configuration in your own environment. AISecurityLabs.org is independent and not affiliated with Anthropic. Setting names change as Claude Code evolves, so check them against the settings reference for your version.