How I keep secrets and personal data out of Claude Code
The problem Claude Code reads whatever a task touches. Ask it to fix a failing job and it opens the .env, tails the log, greps the support export. Everything it reads goes to the model as context. But