Portfolio Safety

portfolio-safety

Three deterministic Claude Code hooks that convert advisory CLAUDE.md prose into enforcement. Packaged so updates propagate via /plugin update instead of N more per-repo PRs.

Hook	Event	What it does
block-secrets	PreToolUse (Write/Edit/MultiEdit/Bash)	Blocks (exit 2) any write whose content — or any git commit whose staged diff — contains a live credential.
rls-required	PreToolUse (Write/Edit/MultiEdit)	Blocks a migration that creates a table in a user schema without enabling Row Level Security on it.
verify-working-tree	SessionStart	Injects branch, dirty files, ahead/behind, last commit, and the filesystem-computed next migration number.

All three use exit code 2 for blocking (exit 1 is a silent no-op — the classic hook footgun — and is never used here).

Install

/plugin marketplace add playerjohnson/claude-portfolio-marketplace
/plugin install portfolio-safety@playerjohnson-portfolio

Install once at user level and it applies across every project. Requires jq (Claude Code already depends on it).

block-secrets — coverage

Structured prefixes (GitHub, Vercel, Supabase sbp_/sb_secret_, Anthropic, Stripe sk_/whsec_, Google AIza, Sentry sntrys_, Resend, Slack, PEM keys, postgres:///redis:// URLs with passwords) plus a high-entropy catch-all for custom tokens (adm_, dpc_, dev JWTs, audit passwords). Allows references, non-secret IDs, and public DSNs. Verified 8/8.

rls-required — behaviour

Fires only on files matching migrations/*.sql. For each CREATE TABLE in a user schema it requires a matching ENABLE ROW LEVEL SECURITY or CREATE POLICY in the same resulting file. Skips temp tables and managed schemas (auth, storage, extensions, cron, vault, realtime, pg_*, supabase_*). Verified 12/12 incl. multiline, multi-table, quoted identifiers.

Escape hatches:

• inline -- rls-exempt: <table> (one table)
• inline -- rls-exempt-file (whole file)
• .claude/rls-allowlist.txt (one bare table name per line)

verify-working-tree — config

Env overrides (set in the command if a repo differs from Supabase layout): MIGRATIONS_DIR (default supabase/migrations), MIGRATION_GLOB (*.sql), MIGRATION_STYLE (auto|seq|timestamp). Never blocks a session.

Relationship to committed per-repo hooks

If a repo already has these committed under .claude/hooks/ (e.g. via the rollout PRs), the plugin and the committed copy both run — they're idempotent and harmless together, but you'll see one duplicate run. Pick one source of truth per repo: keep the committed copy for zero-install team enforcement, or remove it and rely on the plugin for centralized updates.