ccppccpp home

Profiles

Secrets baseline

Secrets stay out of the model's context and out of files, whatever the tool (Read, Grep, a shell); code from the internet is never piped into a shell.

Set this profile

ccpp cpo profile set secrets-baseline

Inside Claude Code, prefix the command with ! to run it in the session. Downloading a profile needs a Builder or Team plan; listing them does not.

Policies

5 policies, grouped by what they guard.

Secrets & private data 4

Credentials, keys and personal data stay out of files, logs, commands and the conversation.

  • credential-files

    Private keys and cloud credentials are never read or written by Claude

  • env-files

    .env files hold secrets; Claude may only touch the committed examples, by any tool

  • no-hardcoded-secrets

    No new credentials (cloud keys, tokens, private keys) written into files

Untrusted input 1

Requests, downloads and tool output are validated before they reach SQL, a shell, eval or a deserializer.

  • no-pipe-to-shell

    Scripts downloaded from the internet are never piped straight into a shell