clade-security-basics

name	clade-security-basics
description	Secure your Anthropic integration — API key management, input validation, Use when working with security-basics patterns. prompt injection defense, and data privacy. Trigger with "anthropic security", "claude api key security", "anthropic prompt injection", "secure claude integration".
allowed-tools	Read, Write, Edit
version	1.0.0
license	MIT
author	Jeremy Longshore <[e-mail]>
compatible-with	claude-code
tags	["saas","anthropic","claude","security"]

Anthropic Security Basics

Overview

Securing a Claude integration means protecting your API key, validating inputs, defending against prompt injection, and handling user data responsibly.

API Key Security

Instructions

Step 1: Never Expose Keys Client-Side

// BAD — key in browser JavaScript
const client = new Anthropic({ apiKey: 'sk-ant-...' }); // EXPOSED TO USERS

// GOOD — key only on server
// api/chat.ts (server-side only)
const client = new Anthropic(); // reads from env

Step 2: Environment Variables

# .env (local dev — never commit)
ANTHROPIC_API_KEY=sk-ant-api03-...

# .gitignore
.env
.env.local
.env.production

Step 3: Rotate Keys Regularly

• Console → Settings → API Keys → Create New Key
• Update all deployments with new key
• Delete old key only after all deployments are updated

Input Validation

// Validate user input before sending to Claude
function validateInput(userMessage: string): string {
  // Limit length to prevent cost attacks
  if (userMessage.length > 10_000) {
    throw new Error('Message too long (max 10,000 characters)');
  }

  // Strip potential PII if not needed
  // const sanitized = redactEmails(redactPhones(userMessage));

   userMessage;
}