Stanley OS: how I work safely with Claude Code
Stanley OS is my internal system for working with Claude Code. Risky commands from automated runs wait for my approval. Below: what it defends against, its controls, how I test it and what I fixed after my own security review.
The code is private, and the screenshot on this page uses invented data.
What it defends against
Some commands an AI assistant runs can delete data; a question costs less than a mistake.
In an automated run nobody watches, text the assistant reads (a web page, a file) could steer it. So risky commands from automated runs wait for my approval.
A key printed by a command can end up in a transcript. So events and transcripts go through redaction before they reach the database.
Controls and tests
Automated runs, started from the console, act on their own only where the guard's rules allow it; anything else waits for Y or N. With no answer, nothing runs.
Before they reach the database, events and transcripts go through one redaction function: patterns for known secret formats, plus the exact values of the secrets Stanley OS holds in its runtime environment.
In the migrations, every table has Row Level Security on, no policy and no grant to anonymous users: as written, only the server has access.
The browser never gets a database key: every read goes through the server.
My rule: a new test only counts once I have seen it fail first.
1,952 mutations in 62 sets: a guarded line is broken on purpose, and its test has to fail.
Checked in the code
- No current secret in the git history: I compared all 262 commits with the values of the local configuration, without printing them, and searched for key-shaped strings. Zero real matches; only test data.
- Every console page sends X-Frame-Options: DENY and Content-Security-Policy: frame-ancestors 'none', and a test checks it. Approval is a single keystroke, so a console framed by another site would be a clickjacking target.
The security review of 24 October 2026
On 24 October 2026 I ran a read-only defensive security review of my own code. I ran the deterministic checks myself: secrets in the git history, RLS and grants in the migrations, risky code (dangerouslySetInnerHTML, eval, shell, SQL built from strings) and npm audit. AI agents read the code in parallel, one area each; one area I did myself. No finding in the code was rated above medium. I confirmed the medium ones myself, in the code or by measurement, and for the low and informational ones I checked that the cited code exists.
Fixed and deployed:
- The automated-run guard took a command that hid another command in parentheses for a read: in PowerShell, Get-Date (Remove-Item x) runs the part in parentheses first, so it deletes. Text injected into an automated run, from a web page or a file, could have used it to write or execute without my approval. Now any opening parenthesis asks for approval.
- Command outputs used to reach the database unredacted. They now go through the same redaction as transcripts before they are stored.
- The list of secrets automated runs may not read on their own was widened to include cloud credentials and other sessions' transcripts.
- Dependencies: npm audit shows 0 vulnerabilities, measured on 26 October 2026, after the Next.js upgrade.
- Each of the three code fixes has a test seen failing first and mutations that guard it.
On this site I publish only what is already fixed and deployed. The fixes, on the security page (in Romanian, with an English summary) →
In numbers
Measured on 26 October 2026, at commit 865ecf9 of the private repository.
Scope and limits
- Only I use it. For my phone, the console also has an online copy, open only to my account, after sign-in. The code is private, and Stanley OS is not a product for sale.
- It is not a sandbox: it checks Claude's tool calls, not a program already running as me. A command I have allowed in advance with a rule skips approval.
- Session recording fails open: if something breaks, the work goes on. Approval fails toward me: with no answer, an automated run does not execute the command, and in my own sessions the request stays in the terminal.
- It relies on third-party services, including a hosted database, a hosting platform for the console's online copy and AI models.
- The automated-run guard and the redaction are lists of rules and patterns, not a scanner: they catch only what they were written to catch.
Questions about its security?
Write to me with what you would like to know; technical details are for a conversation.