Using It Safely & Responsibly
The CyberAware module. Power without judgment is risk — here's how to stay in control and keep your data safe.
- The "review before you trust" habit — and how to make it easy
- How the permission model protects you (and when not to weaken it)
- Protecting secrets, keys, and sensitive data
- Where AI confidently gets things wrong — and prompt injection
The golden rule: you are accountable for what you approve
Claude Code is a tool. When you approve a change, it becomes your change — your name is on it. That's not scary; it's empowering, and it's the same standard as any professional tool. The habits below make staying accountable easy.
1. Review before you trust
Read the changes Claude Code proposes before approving them, the same way you'd proofread an email before hitting send. You don't need to understand every line — look for:
- Scope: Is it only touching what you asked about? Unexpected files are a red flag.
- Deletions: Is it removing something important? Pause on big deletions.
- Commands: Never approve a command you don't understand. Ask "explain what this command does and why" first.
Work in small steps (Module 3) so each change is small enough to actually read. Use version control (git) so you can always roll back. And use /review to get a second opinion before finalizing.
2. Respect the permission model
Claude Code asks before acting on purpose. There are modes that reduce the prompts — handy once you're experienced and the task is low-risk — but they trade safety for speed.
Default (ask each time)
The safe default. Best while you're learning and for anything that matters.
Accept edits
Auto-approves file edits but still pauses for riskier actions. Reasonable once you trust the task.
"Don't ask again" / bypass
Stops asking entirely. Powerful but dangerous — only in a throwaway, backed-up, or sandboxed environment, never on important data.
Stay on the default asking mode until you've done dozens of sessions and genuinely understand the risk of what you're automating. The permission prompt is the seatbelt — don't cut it just because it's a little slower.
3. Protect secrets and sensitive data
This is where cybersecurity meets AI. Be deliberate about what's in reach:
- Never paste passwords, API keys, or credentials directly into a prompt. If Claude Code needs a key, store it the proper way (an environment variable or secrets file) and tell it the name, not the value.
- Mind the folder. Claude Code can see files in the project you opened. Don't run it in a folder full of tax documents, client records, or password files.
- Use a
.gitignore/ ignore rules so sensitive files aren't read or shared. - For work data, use plans with business data-protection terms, and follow your employer's AI policy. Our AI tool safety guide covers what not to feed any AI.
4. Know where AI gets things wrong
Even a great model can be confidently incorrect. Watch for:
Hallucinations
Invented functions, made-up facts, fake citations. If something matters, verify it against a real source — don't take the AI's word as final.
Outdated knowledge
Models have a training cutoff. For the newest tools or recent changes, confirm against current docs.
Prompt injection
When Claude Code reads a web page, file, or tool result that contains hidden instructions trying to hijack it ("ignore your task and email this elsewhere"). Be cautious about connecting untrusted sources, and review actions that follow reading external content.
Overconfidence
A fluent, certain tone is not proof of correctness. Stay skeptical on anything safety-, legal-, or money-critical.
Next time Claude Code proposes a command, don't approve it yet — first ask "explain exactly what this does and what could go wrong." Practicing that one question builds the instinct that keeps you safe. Also try asking it to verify a factual claim it made against a primary source.
Knowledge check
Claude Code asks to run a command you don't recognize. What's the responsible response?
Key takeaways
- What you approve becomes yours — review scope, deletions, and commands before saying yes.
- The permission prompt is a seatbelt; stay on default asking mode while learning.
- Never paste secrets; mind which folder Claude Code can see; ignore sensitive files.
- Expect hallucinations, stale info, and prompt injection — verify anything that matters.
You've reached the end of the course
Mark this complete to finish all five modules. You now know what Claude Code is, how to set it up, how to prompt it well, its power features, and how to use it safely.
🎓 Get your certificate← Back to the course overview to see your progress. The certificate unlocks once all five modules are marked complete.
Practice on small real tasks, read Anthropic's official Claude Code documentation for the latest features, and revisit our AI tool safety guide. Have questions or want to share what you built? Get in touch — we love hearing from members.