Kit / Sample report
A real audit of Kit's own free starter, kit-claude-code-starter @ afb8832, run the same way as a paid one.
Date: 2026-09-19. Inputs: CLAUDE.md, .claude/settings.json, .claude/hooks/format.sh, .mcp.json.example. No repo access, no call.
Last updated: 2026-09-21
The biggest issue: two deny rules look like guardrails but only block one spelling of the command. 5 findings: 2 High, 2 Medium, 1 Low.
| # | Severity | Layer(s) | What we found | Why it matters | Fix |
|---|---|---|---|---|---|
| 1 | High | CLAUDE.md × settings | CLAUDE.md says "Never force-push". settings denies Bash(git push --force:*) only | Deny rules match command text, so git push -f and git push origin main --force aren't blocked (Claude Code docs: a Bash deny rule "isn't a security boundary") | Add Bash(git push -f*) and Bash(git push * --force*), or a PreToolUse hook that rejects any git push containing -f/--force |
| 2 | High | settings | Bash(rm -rf:*) is denied, rm -fr, rm -r -f and rm -Rf are not | Same text-match gap on the most destructive command | Deny Bash(rm -fr*), Bash(rm -Rf*), Bash(rm -r *), or guard rm in a PreToolUse hook |
| 3 | Medium | CLAUDE.md × settings × skill | settings allows npm run typecheck, the ship-check skill runs a type check, but CLAUDE.md lists no typecheck command | ship-check reports type check as FAIL "no command" on every run, and people learn to ignore FAIL rows | Add - Typecheck: npm run typecheck to CLAUDE.md, or drop the allow rule if the repo has no type check |
| 4 | Medium | CLAUDE.md × settings | CLAUDE.md: "Never read or print .env files". settings denies Read(./.env*) but not Bash(cat .env*) | Bash isn't allowlisted for cat, so it prompts rather than runs, but one "Yes, don't ask again" opens it | Also deny Bash(cat .env*) and Bash(* .env*), or keep secrets out of the repo tree |
| 5 | Low | hooks | the format hook runs npx --no-install prettier on .md files too | Reformats CLAUDE.md and READMEs on every edit, producing noisy diffs | Drop *.md from the hook's case list, or add a .prettierignore |
Short CLAUDE.md with real commands; secrets kept out of .mcp.json via env vars; a Stop hook that reminds instead of blocking.
We applied these fixes to the starter itself. The report above stays pinned to afb8832 as the "before".
The written version of this pass is the $79 Kit ladder: Buy Surface Audit $79. Same section: #cc-surface-audit.
Want the fixes applied in your repo? Setup Sprint $99. Custom MCP work: MCP Basic $199. Questions first? Use the intake form.
This is a configuration review, not a security certification.
A written configuration review of the three places a Claude Code rule can live — your CLAUDE.md files, your settings files and your hooks — plus .mcp.json. It is done entirely from what you paste: no repo access, no call, no install. $79, delivered as markdown by email within 48 hours of a clean intake.
Five fixed sections: Summary, Findings, Contradiction map, What’s already good, and Optional next step. The contradiction map is the product — pairs of rules that cannot both hold. Every finding names a file and a line or a settings key, and a finding that cannot cite its line does not ship.
No. Deny rules match command text, so a rule that blocks one spelling of a command does not block the others, and Claude Code’s own documentation says a Bash deny rule is not a security boundary. Two of the five findings in the audit above are exactly that: git push --force denied while git push -f goes through, and rm -rf denied while rm -fr, rm -Rf and rm -r -f do not.
No. It is a configuration review, not a security certification. It will tell you when a deny rule misses a spelling, because that is a rule not doing what your CLAUDE.md says it does. It does not certify anything and you should not show it to anyone as if it did.
Not from a paste. The fix list is written so you can apply it yourself in one sitting. If you would rather someone did it in the repo, that is Setup Sprint $99, and custom MCP work is MCP Basic $199.