Kit / Sample report

Claude Code Surface Audit: sample

A real audit of Kit's own free starter, kit-claude-code-starter @ afb8832, run the same way as a paid one.

Date: 2026-09-19. Inputs: CLAUDE.md, .claude/settings.json, .claude/hooks/format.sh, .mcp.json.example. No repo access, no call.

Summary

The biggest issue: two deny rules look like guardrails but only block one spelling of the command. 5 findings: 2 High, 2 Medium, 1 Low.

Findings

#	Severity	Layer(s)	What we found	Why it matters	Fix
1	High	CLAUDE.md × settings	CLAUDE.md says "Never force-push". settings denies `Bash(git push --force:*)` only	Deny rules match command text, so `git push -f` and `git push origin main --force` aren't blocked (Claude Code docs: a Bash deny rule "isn't a security boundary")	Add `Bash(git push -f)` and `Bash(git push --force*)`, or a PreToolUse hook that rejects any `git push` containing `-f`/`--force`
2	High	settings	`Bash(rm -rf:*)` is denied, `rm -fr`, `rm -r -f` and `rm -Rf` are not	Same text-match gap on the most destructive command	Deny `Bash(rm -fr)`, `Bash(rm -Rf)`, `Bash(rm -r *)`, or guard `rm` in a PreToolUse hook
3	Medium	CLAUDE.md × settings × skill	settings allows `npm run typecheck`, the ship-check skill runs a type check, but CLAUDE.md lists no typecheck command	ship-check reports type check as FAIL "no command" on every run, and people learn to ignore FAIL rows	Add `- Typecheck: npm run typecheck` to CLAUDE.md, or drop the allow rule if the repo has no type check
4	Medium	CLAUDE.md × settings	CLAUDE.md: "Never read or print .env files". settings denies `Read(./.env)` but not `Bash(cat .env)`	Bash isn't allowlisted for `cat`, so it prompts rather than runs, but one "Yes, don't ask again" opens it	Also deny `Bash(cat .env)` and `Bash( .env*)`, or keep secrets out of the repo tree
5	Low	hooks	the format hook runs `npx --no-install prettier` on `.md` files too	Reformats CLAUDE.md and READMEs on every edit, producing noisy diffs	Drop `*.md` from the hook's case list, or add a .prettierignore

Contradiction map

"Never force-push" (CLAUDE.md) vs a deny rule that covers one spelling (settings).
"Run tests before saying done" (CLAUDE.md) vs a ship-check that can't find a type check command.

What's already good

Short CLAUDE.md with real commands; secrets kept out of .mcp.json via env vars; a Stop hook that reminds instead of blocking.

What happened next

We applied these fixes to the starter itself. The report above stays pinned to afb8832 as the "before".

Want the fixes applied in your repo? Setup Sprint $99. Custom MCP work: MCP Basic $199. Questions first? Use the intake form.

This is a configuration review, not a security certification.