How exposed is your coding-agent setup?

Paste your Claude Code settings.json and CLAUDE.md. You get a score out of 10 and the specific gaps. Everything runs in this page; nothing is uploaded. View source if you want to check.

settings.json (project or user level, optional) CLAUDE.md (optional)

Secret files (.env, service-account keys) live inside repos the agent can read

Agents run on machines that hold production credentials (kube config, cloud CLI logged in, prod DB URLs)

Agents run unattended (CI jobs, cron, headless sessions)

The team also uses Cursor or another agent with its own permission model

Grader rules: hooks on Bash and file writes, deny rules for destructive git and shell patterns, whether rules are code or prose, secret reachability, unattended runs, permission bypass flags, and whether anything logs blocked attempts. It reads only what you paste. Built by Daniel Meshulam.