Lock Down the Machine: Workstation Security for Claude Codeexpert · ~135 min

The Assistant Kept Every Draft — Find Every Copy Claude Code Made, and Prove the Next One Is Never Written

You removed the credential from the file, moved it into a vault, and tightened the permissions on the original. So why can a second copy of that same value still be sitting in plaintext on your disk weeks later, in a directory you have never opened, inside a store you did not know your assistant maintained?

🤝 Want this built for you? Start a request — our AI scopes it, estimates a price range, and matches you with a vetted AI Advisor. →

Two ways to open it

Just this build

$40 one-time

Unlocks this full walkthrough on your account — no subscription, and no account needed until you check out. Advisor-grade build.

Best value Rovvi AI Advisor membership

$69 / month

Every Ambassador-exclusive build, first access to new ones, and your spot on the advisor-only needs board. Or $300/year.

Become an Advisor to unlock →

What you'll do

A working four-command retention tool that inventories every Claude Code application-data store on your machine, proves with a planted canary that tool output really does land on disk in plaintext, enforces a chosen retention window and permission chain, demonstrates that a deny rule prevents the copy instead of merely aging it out, and produces a dated one-page evidence record whose exit code says whether your workstation is inside its own policy.