The Claude Code Safety Checklist

One wrong command can wipe hours of work — with no undo. The good news: a few small habits stop almost every "Claude just deleted my project" story before it starts.

This is the checklist I run through on every machine I let Claude Code touch. It takes about ten minutes to set up once, and then it protects you forever. No special tools required — most of it is built into things you already have.

Before you let Claude touch anything

  • Put the project in git. Even a folder you think is throwaway. git init, then commit. Git is your first net — but read the next point, because it is not a complete one.
  • Commit early, commit often. Git only protects what you committed. A file you created an hour ago and never committed is invisible to git — and that is exactly the kind of thing that gets wiped. Get in the habit of committing before you hand the wheel to Claude.
  • Know what git does not cover. Uncommitted changes, untracked files, your .env, a local database, anything in a folder that is not a repo at all — git never had a copy of those. They are gone for good if deleted.
  • Push to a remote. A commit that only lives on your laptop dies with your laptop (or with one bad git reset --hard). Push to GitHub, GitLab, or any remote so there is a copy somewhere you do not control.

Set up a real backup (not just git)

  • Turn on a system backup. Time Machine on macOS, File History on Windows, or any automatic cloud backup (Backblaze, Arq, etc.). This catches the files git will not.
  • Make sure your .env and secrets are backed up somewhere safe. They are deliberately kept out of git, which means they are exactly what you lose when a folder is wiped. A password manager or an encrypted note works.
  • Test that you can actually restore. A backup you have never restored from is a guess, not a backup. Try pulling one file back today.

Work in a way that limits the blast radius

  • Keep one project per folder. If Claude runs a destructive command, you want it scoped to one project — not your whole ~/Desktop or home directory.
  • Do not run Claude Code from your home directory or /. Start it inside the specific project you are working on. A recursive delete is far less scary when there is only one project in reach.
  • Be extra careful with rm, git reset --hard, git clean -fd, and database drops. These are the commands behind almost every horror story. When you see Claude about to run one, read it before you approve it.

Watch what Claude is about to do

  • Read commands before you approve them. Especially anything with rm, -rf, --force, --hard, DROP, or a wildcard *. Ten seconds of reading beats ten hours of lost work.
  • Do not blanket-approve everything. Auto-approving every command is convenient right up until the one time it is not. Keep approval on for destructive actions.
  • Know that "rewind" and checkpoints have limits. Claude Code's checkpoints track its Edit and Write calls — not shell commands run through Bash. An rm -rf runs through Bash, so rewinding does not bring those files back. Do not rely on it as your safety net.

Have a recovery plan before you need one

  • Know your three recovery paths: restore from git, restore from your system/cloud backup, or restore from a tool that snapshots files automatically. Have at least two of the three working.
  • If something gets deleted, stop writing to the disk immediately. The less you do after a deletion, the better your odds if you need file-recovery tools.
  • Decide your "uh oh" move in advance. When work disappears, panic wastes the critical first minutes. Knowing "I check git, then Time Machine, then /restore" turns a disaster into a two-minute fix.

The honest truth

Most of this checklist is free and built into tools you already have. Run through it once and you have closed the door on the overwhelming majority of "Claude deleted my work" stories.

The one gap nothing above fully closes is the uncommitted, gitignored, never-backed-up file — the .env, the local database, the folder you only created twenty minutes ago. That is the exact gap Undeletable was built to fill: it quietly saves a copy of everything before Claude touches it, so even the stuff git and your backups never saw is one /restore away.

But start with the checklist. Most of it costs nothing, and it works.

— Neo at guima.ai