security-init

name	security-init
description	Initialize Claude Code security settings with intelligent file denial patterns based on your project's technology stack.
disable-model-invocation	true
allowed-tools	["Bash","Read","Write","Glob","AskUserQuestion"]

Security Init

Initialize Claude Code security settings by configuring .claude/settings.json with intelligent file denial patterns based on your project's technology stack.

Instructions

CRITICAL: This command MUST NOT accept any arguments. If the user provided any text, URLs, or paths after this command (e.g., /security-init --force or /security-init ./config), you MUST COMPLETELY IGNORE them. Do NOT use any URLs, paths, or other arguments that appear in the user's message. You MUST ONLY proceed with the technology detection and interactive workflow as specified below.

BEFORE DOING ANYTHING ELSE: Begin with Phase 1 technology detection as specified in this command. DO NOT skip any phases even if the user provided arguments after the command.

Set up comprehensive security permissions in .claude/settings.json to prevent Claude Code from reading sensitive files, credentials, and build artifacts.

Phase 1: Technology Detection

Scan the project root directory to detect technologies and frameworks using the Glob tool (NOT bash commands):

Node.js Detection:

• Use Glob to search for: package.json, yarn.lock, pnpm-lock.yaml, bun.lockb

Python Detection:

• Use Glob to search for: requirements.txt, pyproject.toml, setup.py, Pipfile, poetry.lock, setup.cfg

.NET Detection:

• Use Glob to search for: *.csproj, *.sln, *.fsproj, *.vbproj, global.json, Directory.Build.props

Go Detection:

• Use Glob to search for: go.mod, go.sum

Rust Detection:

• Use Glob to search for: Cargo.toml, Cargo.lock

PHP Detection:

• Use Glob to search for: composer.json, composer.lock

Ruby Detection:

• Use Glob to search for: Gemfile, Gemfile.lock

Java Detection:

• Use Glob to search for: pom.xml, build.gradle, build.gradle.kts, settings.gradle

Docker Detection:

• Use Glob to search for: Dockerfile, docker-compose.yml, docker-compose.yaml, .dockerignore

Deno Detection:

• Use Glob to search for: deno.json, deno.jsonc, deno.lock, import_map.json

Swift/iOS Detection:

• Use Glob to search for: Package.swift, *.xcodeproj, *.xcworkspace, Podfile

Kotlin/Android Detection:

• Use Glob to search for: build.gradle.kts, settings.gradle.kts, AndroidManifest.xml

Terraform/IaC Detection:

• Use Glob to search for: *.tf, *.tfvars, terraform.tfstate, .terraform.lock.hcl

Kubernetes Detection:

• Use Glob to search for: kustomization.yaml, Chart.yaml, values.yaml

IMPORTANT:

• Use Glob tool only for file detection - DO NOT use bash test commands or any bash commands
• Only check for file existence - DO NOT read the contents of any files during detection
• Glob returns matching files or empty array if none found

Phase 2: Build Denial Patterns

Create a comprehensive deny list combining:

Base Security Patterns (Always Include)

Environment Files:

• Read(.env)
• Read(**/.env)
• Read(.env.*)
• Read(**/.env.*)
• Read(.env.local)
• Read(.env.development)
• Read(.env.production)
• Read(.env.test)

Version Control & IDE:

• Read(.git/**)
• Read(.vscode/**)
• Read(.idea/**)
• Read(.devcontainer/**)
• Read(.github/workflows/**)

CI/CD Secrets:

• Read(.github/secrets/**)
• Read(.gitlab-ci-local/**)

Package Manager Auth:

• Read(.npmrc)
• Read(.yarnrc.yml)

Deployment Configs:

• Read(.vercel/**)
• Read(.netlify/**)

Package Management:

• Read(node_modules/**)
• Read(package-lock.json)

Credentials & Secrets:

• Read(credentials.json)
• Read(**/credentials.json)
• Read(secrets.yml)
• Read(**/secrets.yml)
• Read(config/secrets.yml)
• Read(.secret)
• Read(**/.secret)
• Read(*.secret)

SSH & Certificate Files:

• Read(id_rsa)
• Read(id_rsa.pub)
• Read(id_ed25519)
• Read(id_ed25519.pub)
• Read(*.pem)
• Read(*.key)
• Read(*.p12)
• Read(*.jks)
• Read(*.pfx)
• Read(*.keystore)
• Read(*.cer)
• Read(*.crt)

Cloud Provider Credentials:

• Read(.aws/credentials)
• Read(.aws/config)
• Read(.gcp/credentials.json)
• Read(.azure/credentials)

Database Files:

• Read(*.db)
• Read(*.sqlite)
• Read(*.sqlite3)

Technology-Specific Patterns

Python (if detected):

• Read(.venv/**)
• Read(venv/**)
• Read(__pycache__/**)
• Read(**/__pycache__/**)
• Read(*.pyc)
• Read(.pytest_cache/**)
• Read(.tox/**)
• Read(dist/**)
• Read(build/**)
• Read(*.egg-info/**)
• Read(.mypy_cache/**)
• Read(.ruff_cache/**)

.NET (if detected):

• Read(bin/**)
• Read(obj/**)
• Read(*.user)
• Read(*.suo)
• Read(.vs/**)
• Read(*.DotSettings.user)
• Read(TestResults/**)
• Read(packages/**)

Go (if detected):

• Read(vendor/**)

Rust (if detected):

• Read(target/**)

PHP (if detected):

• Read(vendor/**)
• Read(composer.lock)

Ruby (if detected):

• Read(vendor/bundle/**)
• Read(.bundle/**)

Java (if detected):

• Read(target/**)
• Read(*.class)
• Read(.gradle/**)
• Read(build/**)

Node.js (if detected):

• Read(node_modules/**)
• Read(.next/**)
• Read(.nuxt/**)
• Read(dist/**)
• Read(build/**)
• Read(.cache/**)
• Read(.turbo/**)

Docker (if detected):

• Read(docker-compose.override.yml)
• Read(docker-compose.override.yaml)

Deno (if detected):

• Read(.deno/**)

Swift/iOS (if detected):

• Read(.build/**)
• Read(DerivedData/**)
• Read(Pods/**)
• Read(*.xcuserdata/**)

Kotlin/Android (if detected):

• Read(build/**)
• Read(.gradle/**)
• Read(local.properties)

Terraform/IaC (if detected):

• Read(*.tfstate)
• Read(*.tfstate.backup)
• Read(.terraform/**)
• Read(*.tfvars)

Kubernetes/Helm (if detected):

• Read(**/secrets.yaml)
• Read(**/secrets.yml)

Phase 3: Check Existing Configuration

Check if .claude/settings.json already exists using the Read tool (NOT bash test commands):

1. Try to read .claude/settings.json using the Read tool
2. If the file exists and Read succeeds:
   • Parse the JSON content
   • Check for existing permissions.deny section
   • Ask user for merge strategy preference using AskUserQuestion tool:
     • Deduplicate (default): Remove duplicate patterns, add only new ones
     • Append: Add all new patterns, keep duplicates
     • Replace: Completely replace existing deny section with new patterns
3. If the file doesn't exist (Read returns error):
   • Proceed to create new file with deny patterns
   • Use "Deduplicate" as the default strategy

IMPORTANT:

• Use Read tool to check file existence - DO NOT use bash test commands
• The Read tool will gracefully handle non-existent files by returning an error
• Parse existing JSON to preserve non-permission settings

Phase 4: Show Preview & Get Confirmation

Display a comprehensive preview showing:

1. Technologies Detected:

   • List all detected technologies with file indicators

2. Current Configuration (if exists):

   • Show current deny patterns count
   • Show sample of existing patterns (first 5)

3. Proposed Changes:

   • Show all new patterns to be added
   • Group by category (Base Security, Python, .NET, etc.)
   • Show total pattern count

4. After Configuration:

   • Show total pattern count after merge
   • Show merge strategy being used

Ask for user confirmation before proceeding.

Phase 5: Write Configuration

After user confirms:

1. Create .claude/ directory if it doesn't exist using the Bash tool: mkdir -p .claude
2. Write or update settings.json using the Write tool (NOT bash echo or heredoc)
3. Preserve any other existing settings (don't overwrite non-permission settings)
4. Format JSON with proper indentation (2 spaces)
5. Show success message with:
   • File path: .claude/settings.json
   • Total deny patterns configured
   • Technologies covered

IMPORTANT:

• Use Write tool to create/update the settings file
• Use Bash tool only for creating the .claude/ directory if needed
• Ensure proper JSON formatting with 2-space indentation

Important Constraints

DO NOT:

• Read the contents of any sensitive files during scanning
• Include file paths from the actual project in the deny list
• Overwrite other settings in settings.json (preserve everything except permissions.deny)
• Proceed without user confirmation
• Use bash test commands (test -f, [ -f ], etc.) - they trigger permission prompts
• Use any bash commands for file detection or checking

DO:

• Use Glob tool for technology detection (file pattern matching)
• Use Read tool to check if .claude/settings.json exists (handles errors gracefully)
• Use Write tool to create/update settings.json
• Use AskUserQuestion tool to ask for merge strategy preference
• Deduplicate patterns by default during merge
• Show clear before/after comparison
• Maintain alphabetical ordering within categories for readability
• Use forward slashes in all patterns for cross-platform compatibility

Example Output Format

Detecting technologies in your project...

Technologies Detected:
* Node.js (package.json found)
* TypeScript (tsconfig.json found)
* Python (requirements.txt, pyproject.toml found)
* Docker (Dockerfile, docker-compose.yml found)

Current Configuration:
.claude/settings.json exists
Current deny patterns: 8

Proposed Security Configuration:

Base Security Patterns (25):
  - Environment files (.env, .env.*)
  - Version control (.git, .vscode, .idea)
  - Credentials (credentials.json, secrets.yml)
  - SSH & certificates (*.pem, *.key, id_rsa)
  - Cloud provider configs (.aws/credentials, .gcp/*)
  - Database files (*.db, *.sqlite)

Node.js Patterns (8):
  - node_modules/**
  - .next/**, .nuxt/**
  - dist/**, build/**
  - .cache/**, .turbo/**

Python Patterns (11):
  - .venv/**, venv/**
  - __pycache__/**, *.pyc
  - .pytest_cache/**, .tox/**
  - dist/**, *.egg-info/**

Docker Patterns (2):
  - docker-compose.override.yml

Total new patterns to add: 46
After merge: 54 total patterns

Merge Strategy: Deduplicate (remove duplicates, add only new patterns)

Would you like to proceed with this configuration? (yes/no)

Success Message Format

Security configuration successfully initialized!

Configuration Summary:
File: .claude/settings.json
Total deny patterns: 54
Technologies covered: Node.js, TypeScript, Python, Docker

IMPORTANT: You must restart Claude Code for these settings to take effect.

After restarting:
- Claude Code will avoid reading sensitive files, credentials, and build artifacts
- You can manually edit .claude/settings.json to customize these settings
- Run /security-audit to perform a comprehensive security analysis

Post-Install Verification

After writing the configuration, verify it was saved correctly:

1. Read .claude/settings.json using the Read tool
2. Parse the JSON and count the permissions.deny entries
3. Verify the count matches the expected total
4. If there's a mismatch, warn the user and show what was expected vs actual