Claude Code reads your .env files without asking. I tested it.

It does. The usual advice is deny rules in settings.json or .claudeignore.

Tried both. Deny rules don't cover Bash commands, which the official docs actually say outright. .claudeignore has had enforcement bugs for months. But what kept bugging me past the enforcement stuff: if you successfully block Claude from reading your .env, now it can't use your secrets at all. You still need that API key in a curl header. You still need the database creds to run the server.

Let Claude read the file and the value is in the context window forever. Block the read and Claude can't do the thing you need it to do.

I ended up building a Claude Code plugin called Blindfold. Secrets live in your OS keychain. Claude never touches the actual values.

You tell Claude to store a token. A password dialog pops up on your machine, you type the value, it goes to the keychain. Claude gets back "OK: stored." That's all it knows.

When it needs the token in a command, it writes:

secret-exec.sh 'curl -H "PRIVATE-TOKEN: {{GITLAB_TOKEN}}" https://gitlab.com/api/v4/user'

A wrapper pulls the real value from the keychain in a subprocess, runs the curl, and replaces the token with [REDACTED:GITLAB_TOKEN] in the output before Claude sees it.

PreToolUse hook blocks any direct keychain reads or cat on registered .env files. PostToolUse hook scans output in case something gets through.

After storing my GitLab token through it, I just asked Claude what the last three characters were. Nothing. Asked for the full value. Nothing. It was never in the conversation.

Handles .env files as profiles too. Register "staging" or "production," Claude runs commands with those vars injected, values scrubbed from output.

macOS Keychain, Linux secret-tool/GPG, Windows Credential Manager. Terminal prompt fallback for SSH.

/plugin marketplace add thesaadmirza/blindfold
/plugin install blindfold@blindfold

https://github.com/thesaadmirza/blindfold