Before You Learn Anything, Score Yourself
What you need
What this course was checked against
The six sections
Do this now, before Lesson 2
Where you are starting from
2 attempts allowed
The Test That Turns a Claim Into Evidence
fire.sh
The --bare flag, and why your score is probably wrong
Counting what is registered
Exit codes and evidence
2 attempts allowed
Section 1 — Hooks (15 points)
Check 15 deserves its own paragraph
Fire three of your own
Section 2 — Git Protection (10 points)
Check 21 is the one people get wrong
Check 25 is not a hook
Git protection
2 attempts allowed
Section 3 — Credentials and Secrets (8 points)
Check 26, done properly
Check 33 is about the past, not the present
Credentials
2 attempts allowed
Section 4 — Token and Cost (7 points)
The one that has teeth
A note on check 34
Cost
2 attempts allowed
Section 5 — Autonomous Operation (5 points)
Check 42 is the one that protects all the others
Check 45 is not a hook
Autonomous operation
2 attempts allowed
Section 6 — Team and Multi-Agent (5 points)
Check 50, the one worth testing
A working definition of check 48
Team and multi-agent
2 attempts allowed
The Guards That Failed Silently
The pattern
Now score yourself again
What a verified score means
2 attempts allowed
Where to go next
The Audit Sheet — All Fifty Checks
Hooks (15 points)
Git Protection (10 points)
Credentials and Secrets (8 points)
Token and Cost Management (7 points)
Autonomous Operation (5 points)
Team and Multi-Agent (5 points)
Scoring Guide
How to Use This Checklist
Quick Verification Commands
Three of these could not fail
The Claude Code Safety Audit
Fifty checks, and the evidence that proves each one - fire your own hooks by hand, read the exit code, and score what you can actually demonstrate.
Score your Claude Code setup out of 50, then prove it by firing your own hooks by hand and reading the exit code. Six sections, a free MIT-licensed toolkit, and eight dated incidents where the guard failed silently.
Minimum price
$49.00
$59.00
You pay
Author earns
About
About the Course
Almost everyone who has installed Claude Code safety hooks believes they are protected. Very few have ever watched one refuse anything. Those are different states, and only one of them survives contact with a bad command.
This course is a 50-point audit of your own setup, and the evidence for each point. You score yourself from memory first, then learn the one-command test that fires a hook by hand and reads its exit code - 2 means refused, 0 means the command runs. Then you apply it across six sections: hooks, git protection, credentials and secrets, token and cost, autonomous operation, and team and multi-agent work. At the end you score yourself again. The gap between the two numbers is the finding.
The toolkit is free and MIT-licensed, at github.com/yurukusa/cc-safe-setup/tree/main/audit - four scripts you run against whatever you already have, kept in the open so that fixes reach you. fire.sh hands a hook the operation it is supposed to refuse and prints the decision, with a --bare mode that removes jq, python3 and node from PATH - the state of a slim container, where a hook that parses JSON with jq exits 0 and lets the command through. count-hooks.py reads all three settings files rather than one. find-dead-hooks.sh lists registrations whose script is not on disk, which produce no error and no symptom. selftest.sh proves that detector really detects. The 50-point audit sheet is in the course and in the toolkit. You are paying for the method and the order, not for the scripts.
The final lesson is eight dated incidents from one autonomous Claude Code operation running since 2026-02-15 - a single operator, personal repositories, no team and no production service. Seven of the eight produced no error visible to the operator, and four produced output that suggested everything was fine. Each is paired with the check that would have caught it.
You do not need my hooks or my repository; every check works against your own setup. If you already own the book Claude Code Safety Mastery, you have read this material as reference - buy this only if you want to be walked through proving it on your own machine.
Written by an independent operator who runs Claude Code autonomously and maintains cc-safe-setup, a free MIT-licensed collection of 914 example safety hooks: https://github.com/yurukusa/cc-safe-setup
Before you buy, here is the honest three-way split. Free: the toolkit and the 50-point sheet, MIT-licensed at github.com/yurukusa/cc-safe-setup/tree/main/audit - take them and run your own audit, you owe nothing. The book, Claude Code Safety Mastery ($19-29): the same six areas as reference - what each hook does, why it is written that way, and the eight incidents in full. This course ($29-39): the order to do it in, the evidence standard for each of the fifty checks, 21 graded questions, and a certificate at the end. If you already own the book, you have read the material - buy this only if you want to be walked through proving it on your own machine.
Checked on 2026-08-27 against Claude Code 2.1.246, bash 5.2.21 on Linux 6.6.87 (WSL2), Python 3.12.3, jq 1.7 - and deliberately without jq, for the --bare runs. The course pins the exact toolkit commit it was verified against, so you can tell a version change from a mistake in your setup. Not affiliated with or endorsed by Anthropic. The certificate records that you completed this self-audit; it is not a security certification and it does not attest that any setup is safe.
Instructor
About the Instructor
Everything I publish starts from something that actually broke.
I run Claude Code on real projects, often unattended, and I have lost work to it. The hooks in cc-safe-setup (MIT, open source) exist one per incident — each guard is there because of a specific thing that went wrong. The books are the write-ups: what failed, what the logs looked like, and what finally stopped it.
Two things I hold myself to. If a number in one of my books is not something I measured, it says so. And if a command is printed, the output beside it came back from an actual run — failures included, because a check that cannot fail is not a check.
I am not selling certainty. Most of what I know here, I learned by breaking my own setup.
Material
Course Material
The Leanpub 60 Day 100% Happiness Guarantee
Within 60 days of purchase you can get a 100% refund on any Leanpub purchase, in two clicks.
See full terms...
Earn $8 on a $10 Purchase, and $16 on a $20 Purchase
We pay 80% royalties on purchases of $7.99 or more, and 80% royalties minus a 50 cent flat fee on purchases between $0.99 and $7.98. You earn $8 on a $10 sale, and $16 on a $20 sale. So, if we sell 5000 non-refunded copies of your book for $20, you'll earn $80,000.
(Yes, some authors have already earned much more than that on Leanpub.)
In fact, authors have earned over $15 million writing, publishing and selling on Leanpub.
Learn more about writing on Leanpub
Free Updates. DRM Free.
If you buy a Leanpub book, you get free updates for as long as the author updates the book! Many authors use Leanpub to publish their books in-progress, while they are writing them. All readers get free updates, regardless of when they bought the book or how much they paid (including free).
Most Leanpub books are available in PDF (for computers) and EPUB (for phones, tablets and Kindle). The formats that a book includes are shown at the top right corner of this page.
Finally, Leanpub books don't have any DRM copy-protection nonsense, so you can easily read them on any supported device.
Learn more about Leanpub's ebook formats and where to read them
Write and Publish on Leanpub
You can use Leanpub to easily write, publish and sell in-progress and completed ebooks and online courses!
Leanpub is a powerful platform for serious authors, combining a simple, elegant writing and publishing workflow with a store focused on selling in-progress ebooks.
Leanpub is a magical typewriter for authors: just write in plain text, and to publish your ebook, just click a button. (Or, if you are producing your ebook your own way, you can even upload your own PDF and/or EPUB files and then publish with one click!) It really is that easy.