The single most important line you will ever write. If your .env reaches a public repo, every key inside it is compromised. This takes 3 seconds and prevents the most common security incident in developer tooling.

# Run from your project root
echo ".env" >> .gitignore && echo ".env.local" >> .gitignore

Blocks Claude from editing credentials files automatically. This hook runs before every file edit and rejects changes to sensitive paths. Think of it as a guardrail for your most dangerous files.

#!/bin/bash
# file-protection.sh, PreToolUse hook for Edit + Write

FILE="$CLAUDE_FILE_PATH"

case "$FILE" in
  *.env|*.env.*|*credentials*|*secrets*)
    echo "BLOCKED: Cannot edit $FILE, sensitive file"
    exit 1
    ;;
  *settings.json)
    echo "WARNING: Editing settings.json, proceed with caution"
    ;;
esac

exit 0

# Install the hook
cp file-protection.sh ~/.claude/hooks/ && chmod +x ~/.claude/hooks/file-protection.sh

Generate new keys, replace them in your .env, and delete the old ones on the platform. If a key has ever been in a git diff, treat it as compromised, even if you force-pushed over it.

• OpenAI platform.openai.com/api-keys. Revoke old key, generate new, update .env
• Anthropic console.anthropic.com/settings/keys. Same process. Check all workspace keys
• GitHub github.com/settings/tokens. Use fine-grained tokens with minimal scope
• Stripe dashboard.stripe.com/apikeys. Rotate both test and live keys separately

# After rotating, verify your .env is NOT tracked
git status --porcelain | grep ".env"
# If this returns anything, your .env is still tracked, fix .gitignore first

Claude reads MEMORY.md every session. API keys stored in that file become part of every single prompt you send. That means they travel through the network, get logged, and persist in conversation history.

Use GitHub search to find any exposed .env files across your organization. One leaked file from a test repo six months ago is enough. This takes 30 seconds and could save you from a breach.

# Search for .env files in your GitHub org
gh search code --filename=".env" --owner=YOUR_ORG

# Search in a specific repo
gh search code --filename=".env" --repo=YOUR_ORG/YOUR_REPO

# Also check for common secret patterns
gh search code "sk-" --owner=YOUR_ORG
gh search code "OPENAI_API_KEY" --owner=YOUR_ORG