Lock Down the Machine: Workstation Security for Claude Codeexpert · ~130 min

The Key That Signed Without You — Prove Nothing on Your Machine Borrows Your SSH Identity

You put a passphrase on your SSH key, and that felt like the end of the conversation. It was not. The passphrase protects a file sitting on your disk — but the moment you type it once, a small background program called an agent holds the unlocked key on your behalf, and from then on anything running as you can ask that agent to sign as you, silently, with no passphrase and no prompt. Not through a bug. That is the feature. So the real question about your workstation is not "is my key encrypted?

" It is: right now, at this second, which identities on this machine will act as me without asking, for how much longer, and would I ever find out? This project answers that with commands whose output you read yourself, then installs the two controls that actually narrow it, and proves each one by watching your own machine refuse.

🤝 Want this built for you? Start a request — our AI scopes it, estimates a price range, and matches you with a vetted AI Advisor. →

Two ways to open it

Just this build

$40 one-time

Unlocks this full walkthrough on your account — no subscription, and no account needed until you check out. Advisor-grade build.

Best value Rovvi AI Advisor membership

$69 / month

Every Ambassador-exclusive build, first access to new ones, and your spot on the advisor-only needs board. Or $300/year.

Become an Advisor to unlock →

What you'll do

A four-subcommand tool you own that reports which private keys on your workstation are genuinely encrypted at rest without ever decrypting one, which identities your live agent will use with no human in the loop, and what OpenSSH will really do per host according to `ssh -G` rather than according to your config file — plus a declared policy file it checks against, a three-state exit contract that refuses to report "clean" when it could not establish the facts, confirmation and lifetime controls installed on your real keys, and four completed drills in which you watched a passphrase-protected key sign a canary with no prompt, watched a wildcard config block silently overrule an explicit per-host setting, watched the same signing attempt be refused after you installed the control, and watched the report exit non-zero rather than bless a machine it could not read.