Claude Code can run DROP DATABASE, prisma migrate reset, rails db:drop, or php artisan migrate:fresh without warning in Auto Mode. One command and your production data is gone.
#401 — Claude loaded .env with production database URL and ran tests that wiped the production database.
The block-database-wipe hook catches:
DROP DATABASE / DROP TABLEprisma migrate reset / prisma db push --force-resetrails db:drop / rails db:resetphp artisan migrate:freshdjango-admin flush / python manage.py flushsequelize db:dropTRUNCATE TABLEnpx cc-safe-setup --install-example block-database-wipeOr include it in the full safety setup:
npx cc-safe-setup --shieldIf Claude loaded your .env with DB_DATABASE=production_db and then ran php artisan migrate:fresh, the hook would block it. But the root cause is .env loading into the shell — fix both.
npx cc-safe-setup --install-example block-database-wipe667 hooks. 9,200+ tests.
cc-safe-setup · GitHub