What is sensitive-file-guard?
sensitive-file-guard is a Claude Code mod by Justmalhar that blocks Read, Write, Edit, Grep, Glob and Bash calls that touch .env files, private keys and credential stores. It is listed under Security and has 1 GitHub stars.
| Type | Claude code mod |
|---|---|
| Author | Justmalhar |
| Repository | Justmalhar/awesome-claude-mods |
| Popularity | 1 GitHub stars |
| Category | Security |
| Security | Low risk (100/100) |
| Rank | #1,893 of 5,272 Claude Code mods; #225 in Security |
| License | MIT |
| Last commit | 2026-10-04 |
| Hooks | 1 events |
| Sees | every tool call |
| Draws on | nothing |
Is sensitive-file-guard safe to install?
sensitive-file-guard scores 100/100 on the MCPMods security check: Low risk. No checks raised a concern. It passed 8 of 8 checks.
Mod footprints come from claude plugin validate, which lists every event a mod hooks and every API call it makes without running it.
| Check | Result |
|---|---|
| No network access | Pass |
| Starts no processes | Pass |
| Writes no files or config | Pass |
| Doesn't read environment variables | Pass |
| Only sees the events it hooks | Pass |
| Doesn't drive Claude | Pass |
| Passes claude plugin validate | Pass |
| Has an open-source license | Pass |
How do I install sensitive-file-guard?
- Check your Claude Code version. Mods need Claude Code 2.1.287 or later and are on by default.
claude --version
- Read its footprint. This lists every event it hooks and every API call it makes, without running it.
git clone https://github.com/Justmalhar/awesome-claude-mods claude plugin validate ./awesome-claude-mods/mods/sensitive-file-guard
- Install it. Run this in your terminal, then /reload-plugins in an open session.
claude plugin marketplace add Justmalhar/awesome-claude-mods && claude plugin install sensitive-file-guard@awesome-claude-mods
Or ask Claude to set it up
Paste this into Claude Code and it installs sensitive-file-guard for you:
Install the "sensitive-file-guard" Claude Code mod from https://github.com/Justmalhar/awesome-claude-mods/tree/main/mods/sensitive-file-guard. Run claude plugin validate on it first and show me what it can access before you enable it.
More from Justmalhar/awesome-claude-mods
This repository has at least 9 Claude Code mods on MCPMods.
- auto-checkpoint: Snapshots the working tree into hidden git refs at the start of every turn, with /checkpoints to list them and /undo-tur (Low risk)
- branch-guard: Stops Claude from editing files or running mutating git commands on main or master, and points it at a worktree instead. (Low risk)
- cost-bar: A one-row band above the prompt with session cost, 5h/7d plan limits and an optional budget bar. (Low risk)
- file-tree-pane: Adds /tree: a side pane with a lazy file tree coloured by git status. Press a file to put @path in the prompt. (Low risk)
- notify-on-finish: Sends a desktop notification when a long turn finishes, so you can look away while Claude works. (Low risk)
- path-guard: Blocks Write, Edit and MultiEdit calls that target a path outside the project root or inside .git, plus optional deny gl (Low risk)
- powerline-bar: A one-row powerline-style band above the prompt: directory, git branch and state, model, context fill. (Review before installing)
- secret-guard: Blocks Write, Edit and Bash calls that would put an API key, token or private key into a file or command. (Low risk)