
How to run coding agents safely: permissions, sandboxes and secrets
How to run coding agents safely with Claude Code permission modes, Codex sandbox and approval settings, deny rules, and habits that keep secrets out of reach.
An agent skill that runs build, tests and lint, checks secrets, env vars and database access, then answers READY, READY WITH WARNINGS or BLOCKED.
It reports first and fixes nothing unless you ask. Dashboard checks are marked NEEDS HUMAN.
# Pre-deploy check
Run these steps in order. Do not fix anything unless the user asks; report first.
## 1. Build and tests
- Find the project's build, test and lint commands in `package.json` scripts, `AGENTS.md` or the README. Do not invent commands.
- Run each one. Record the command, pass or fail, and the key lines of any failure.
## 2. Secrets
- Search the diff against the main branch for hard-coded keys, tokens, passwords or connection strings.
- Flag any secret-looking value that is not read from an environment variable.
- Flag any server-only secret referenced with a public prefix (for example `NEXT_PUBLIC_`).
- Check `.gitignore` covers `.env` and `.env*.local`, and that no such file is tracked (`git ls-files | grep -i '\.env'`). `.env.example` with names only is fine.
SKILL.mdAnyone who deploys straight from an agent session.

How to run coding agents safely with Claude Code permission modes, Codex sandbox and approval settings, deny rules, and habits that keep secrets out of reach.

MCP security best practices for vibe coders: prompt injection risks, what the MCP spec requires, and a checklist to use MCP servers without leaking data.

Git and GitHub basics for vibe coders: the commands you need, a branch-per-task workflow for coding agents, .gitignore for secrets, and push protection.
The Codema publication. Consent is required. You are not subscribed until you confirm from the email, and nothing is stored if email delivery is not connected.