Safe Mental Model — Claude Code Guide

A session leaves digital traces

Closing the terminal does not guarantee that all data disappears. During work, conversation history, transcripts, command results, Git diffs, logs, snapshots, and automatic memory records may remain.

If Claude received data through text, a file, or a command, assume that a local trace may remain. Check any artifact before sharing it.

• Internal domains, IP addresses, and paths.
• Tokens, keys, and configuration values.
• Email addresses, customer data, and order identifiers.
• Outdated or incorrect versions of technical information.

Keep secrets local

Use `.env.example` rather than a real `.env` to analyze configuration. You do not need to give Claude real keys to check variable names or template completeness.

Secrets can enter not only files but also container environment variables, logs, CSV files, dumps, webhook configuration, and payment records.

.env
.env.*
!.env.example
.claude/CLAUDE.local.md
.claude/settings.local.json

POSTGRES_URL=postgres://app:LOCAL_PASSWORD@localhost:5432/commerce
STRIPE_SECRET_KEY=sk_test_PLACEHOLDER
SUPPORT_API_TOKEN=LOCAL_TOKEN
PAYMENT_WEBHOOK_SECRET=LOCAL_SECRET

Sanitizing logs and transcripts

1. Remove lines that are not needed for diagnosis.
2. Replace tokens, keys, and passwords with REDACTED.
3. Hide internal addresses, email addresses, and personal identifiers.
4. Keep only a short fragment around the required error.
5. Check the cleaned version before publishing it in a ticket, chat, or repository.

Authorization: Bearer REDACTED
Webhook host: internal.example.test
Customer email: user-001@example.test
Request id: REDACTED

Long sessions need context hygiene

A large context can reduce work quality: Claude starts mixing tasks, repeating false assumptions, forgetting constraints, or proposing changes that are too broad.

If a session has become confusing, it is better to shorten the context, split the tasks, or start a new session than to keep layering clarifications indefinitely.

/usage
/help

# To reduce history in the active session
/compact

A safe mental model

A reliable workflow combines a Git baseline, minimal permissions, explicit project instructions, local data hygiene, and human review. None of these layers is sufficient on its own.

Give Claude only the minimum necessary context, do not reveal real secrets, review the diff, and independently check key behavior regardless of how confident the agent’s response sounds.

1. Prepare a clear Git state and task boundaries.
2. Provide only the necessary permissions and context.
3. Use .env.example instead of .env.
4. Check the diff, tests, and side effects.
5. Sanitize the transcript, log, or screenshot before sharing it.