Security checklist for Claude Code and Duet users
Six actions for agents with account access: rotate API keys, set spend caps, prune connected apps, keep approval prompts on, update tools, never paste passwords.
Matt Shumer's Black October guide hit 1.5M views. it's written for your parents if you run Claude Code, Duet or any agent with access to your accounts, here's the version for you what's already public: a cloud platform used by ~2M developers said customers' secret keys may have been accessed. Axios reports major US banks finding unauthorized AI agents inside customer accounts 6 things to do tonight: → rotate every API key that lives in a .env file or a cloud dashboard → put a hard monthly spend cap on each key, so a stolen one hits a ceiling instead of your card → open every agent's connected apps and cut what you don't use this week. email, bank and calendar first → keep "ask before send, pay, sign, delete" on. no auto-approve for anything that moves money → update Node, your terminal tools and Claude Code. Node.js shipped security releases for 22, 24 and 26 this week → never paste a password or a one-time code into an agent chat 10 minutes. most of it is clicking "revoke" the full guide for your family is in the quote ↓ https://x.com/mattshumer_/status/2113360930876580337
This post quotes another post: x.com/mattshumer_/status/2113360930876580337