Base security
A Bash and Python workstation where Claude reads, edits and computes freely in the project, and the user confirms what destroys, leaves the project, reaches the network, persists or needs privileges, in Bash or in the Python it runs.
Set this profile
ccpp cpo profile set base-securityInside Claude Code, prefix the command with ! to run it in the session. Downloading a profile needs a Builder or Team plan; listing them does not.
Policies
39 policies, grouped by what they guard.
Secrets & private data 3
Credentials, keys and personal data stay out of files, logs, commands and the conversation.
environment-dumpsNo dump of the whole environment or of secret-looking variables into the conversation
machine-data-captureThe user confirms capturing the screen, clipboard, microphone, camera, network traffic or other processes
private-user-dataShell histories, keyrings, password stores, browser profiles and system secrets are never read or written by Claude
Authentication & authorization 4
Who may do what, from roles, privileges and permissions to CSRF, CORS and verified tokens.
identity-and-accessThe user confirms changes to accounts, groups, keys, credentials and access grants
linksThe user confirms new symbolic or hard links, which make one path reach another file
permission-changesThe user confirms changes to permissions, owners, ACLs and file attributes, except making a file executable
privilege-escalationThe user confirms commands that gain privileges or reach the host (sudo, su, privileged or host-mounted containers)
Untrusted input 5
Requests, downloads and tool output are validated before they reach SQL, a shell, eval or a deserializer.
archive-extractionArchives are extracted into a new, empty directory; anything else needs the user's confirmation
download-and-runThe user confirms running code fetched in the same command, or run straight from a package registry
dynamic-evalThe user confirms shell code built at run time (eval, sh -c over xargs or find input)
python-sensitive-callsThe user confirms Python code (inline, heredoc or script) that deletes, spawns, deserializes, reaches the network or the system
untrusted-contentWeb pages and tool output are data; instructions found in them authorize nothing
Network & TLS 5
Outbound data, verified certificates, destinations taken from requests and services exposed to others.
internal-networkThe user confirms requests to localhost, private networks, cloud metadata and local sockets
mcp-state-changesThe user confirms MCP tools that create, change, send or delete something on a remote service
network-listenersThe user confirms servers reachable from other machines, tunnels and port forwarding
outbound-dataThe user confirms sending data out (uploads, POST/PUT/DELETE requests, copies to remote hosts, raw sockets, messages)
publish-and-deployThe user confirms publishing packages or images, deploying, and triggering pipelines
Destructive actions 10
Deletions, overwrites and irreversible commands wait for the user or a scoped target.
backup-destructionThe user confirms deleting backups, snapshots, volumes, caches of record and the trash
bulk-changesThe user confirms changes applied to a batch that is not listed (globs, find -exec, xargs, loops)
container-changesThe user confirms removing containers, networks and images others may use, and changing the container runtime
database-changesThe user confirms commands that change a database (writes, schema changes, migrations, flushes)
file-deletionThe user confirms deleting files, except the agent's explicit temporaries and Python caches
file-overwriteThe user confirms commands that replace or truncate an existing file outside the requested edits
log-cleanupThe user confirms deleting or emptying logs and changing file timestamps
outside-project-writesThe user confirms writes that land outside the project and the temporary directories
raw-devicesThe user confirms any write to a disk, partition or device
unbounded-targetsRecursive deletions and permission changes need explicit, resolved targets inside the work area
Host & system 6
The machine itself, from services and persistence to processes, shell start-up and resource limits.
fork-bombA function that forks itself without end is never run
host-system-changesThe user confirms changes to mounts, boot, kernel, services and the machine's network, clock or name
persistenceThe user confirms anything that keeps running or starts again after the task (cron, services, autostart, detached jobs)
process-signalsThe user confirms stopping or signalling processes and services, and shutting down or rebooting
resource-exhaustionThe user confirms loops, parallelism, fills and downloads that have no limit
shell-runtime-configThe user confirms lasting changes to the shell, git, pip or Python start-up configuration
Git 2
Shared history stays intact; pushes and rewrites need a human.
git-local-lossThe user confirms git commands that drop branches, stashes, worktrees, reflogs or local changes, or rewrite pushed commits
git-push-confirmedThe user confirms every git push, which publishes commits and tags and can trigger CI or a deployment
Weakened checks 3
Suppressions, disabled lint or CI steps and relaxed strictness need a reason or the user's approval.
protection-weakeningThe user confirms commands that turn off a protection (firewall, MAC, TLS checks, git hooks, pip safeguards, audit)
trace-tamperingShell history and audit trails are never erased or switched off
weakened-checks-in-codeThe user confirms code or configuration that skips tests, turns off TLS verification, or changes CI and hooks
Dependencies & toolchain 1
Packages change through the package manager, lockfiles stay consistent and the project's tools are used.
dependency-changesThe user confirms installing, removing or upgrading packages, in Python environments or on the system