cc-safety-net blocks destructive commands before your coding agent runs them
cc-safety-net is a Claude Code hook that refuses the git discards, deletes and secret reads before a coding agent runs them. It refused nearly all of those; database commands need rules you write.
Verdict: Adopt cc-safety-net with care if Claude Code runs shell commands for you without your approval, and install it at the default level even if you approve every command yourself: Claude Code's file tools read files without asking, and the hook's built-in list of credential files saves writing a Read deny rule for each. At that level it refused 62 of the 64 listed destructive commands we tried, but no database command, and 1 of 44 everyday commands.
