Security

Security model and vulnerability reporting for Claude Code Setup.

Trust Model

Claude Code Setup modifies files in ~/.claude/ and ~/.claude.json. Understanding the trust model:

What We Install

User Responsibility

• Custom modules: You’re responsible for reviewing custom module repositories before using /add-custom
• API keys: Store in environment variables or .env files, never in CLAUDE.md
• MCP servers: npm packages are third-party; review before enabling

Best Practices

API Keys

Never put secrets in CLAUDE.md:

<!-- BAD - Don't do this -->
API_KEY=sk-secret-123
 
<!-- GOOD - Reference location -->
API keys are in ~/.config/secrets/.env

Custom Modules

Before installing custom modules:

1. Review the repository
2. Check the SKILL.md and MCP configs
3. Verify the source is trusted

File Permissions

The installer creates files with default permissions. For sensitive configs:

chmod 600 ~/.claude.json  # Restrict MCP config with API keys

Vulnerability Reporting

Found a security issue?

1. Do not open a public issue
2. Use GitHub’s private vulnerability reporting
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact

We’ll respond within 48 hours.

Security Updates

Security fixes are released as soon as possible:

1. Patch is developed and tested
2. Released with fix(security): commit
3. Users update via /claude-code-setup

Check the Changelog for security updates.

Auditing

Check Installed Modules

./install.sh --list

Review MCP Configuration

cat ~/.claude.json

Check Custom Modules

ls ~/.claude/custom/
cat ~/.claude/installed.json