secure by default · human in the loop

Claude Secure Template

A guarded workshop where AI does the work and nothing ships unchecked.

A production-ready starting point for building software with Claude. Work comes in, gets routed to whoever should do it — a person, Claude, or a cheaper local model — and every change passes the same security gates before it merges.

The routing switchboard

Work arrivesAn issue on the board — a bug, a feature, a chore.
Human
Judgment calls, approvals, anything sensitive.
Claude
Architecture, security, cross-cutting or unclear work.
Local model
Formatting, docs, small low-risk edits — near-free.
✓ security gates — secrets · SAST · container scan — must pass
MergedReviewed, scanned, and tracked back to the issue.

For anyone

Why it exists

Three ideas do most of the work. You don't need to read code to get them.

Safe by default

The environment is locked down — the network can only reach an approved list, and secrets never touch the repo. Guardrails are on before the first line is written.

Cheap work goes local

Low-risk tasks are handed to a free model running on your own machine. Claude is spent only where its judgment is worth the cost.

Humans stay in control

Every task is a tracked card and every change is a reviewed pull request. Nothing merges until the automated checks agree.

For engineers

The five moving parts

Each is a self-contained piece of the template. Together they turn a blank repo into a governed, AI-assisted delivery pipeline.

Devcontainer.devcontainer/
A reproducible dev environment with a deny-by-default firewall — egress is allowlisted, tooling is pre-installed, Claude auth is a mounted volume.
AI routingscripts/route-model.sh
Classifies each task and sends it local vs Claude by risk. Hard triggers — auth, networking, broad refactors — always escalate to Claude.
BMAD workflow/bmad
Structured planning in six stages, Discovery through Security & Release, so features are scoped before they're built.
Kanban board/next-issue · /run-epic
A per-repo GitHub Project. Agents claim cards collision-free; a Route field makes the human/Claude/local decision visible on every card.
CI security gates.github/workflows/
gitleaks secret scanning, semgrep SAST (incl. MITRE ATLAS AI/ML rules), and Trivy container scanning — all enforced, not advisory.

Under the hood

How the pieces actually work

Four close-ups: the sealed environment, the two engines behind the routing, the token compressor, and the gates every change runs.

The devcontainer

.devcontainer/
deny-by-default firewall
container · node:24 (digest-pinned)
Claude CLI VS Code extension gitleaks semgrep pre-commit python3 · node
mount · ~/.claude auth mount · gh auth
egress allowed → GitHubnpmPyPI api.anthropic.comVS Marketplace
everything else → REJECT
host machine · Ollama reachable only on :11434 → local model, never leaves your box

Auth lives in mounted volumes, never in the repo. The firewall opens the network to a short allowlist and blocks the rest — set once at container start.

Two engines behind the routing

scripts/route-model.sh
Claude
cloud · paid · escalate here
  • Architecture & cross-cutting design
  • Security, auth, secrets
  • Firewall / networking changes
  • Broad refactors, unclear debugging
judgment worth the tokens
Local model · Ollama
on-host · free · default for low risk
  • Formatting & boilerplate
  • Docs updates
  • Tiny single-purpose refactors
  • Simple renames & tests
private · fast · near-zero cost

A task is classified by type and risk; any hard trigger — auth, networking, 8+ files — always escalates to Claude. The same decision shows up as the Route field on the board card.

Caveman — token compression

scripts/install-caveman.sh
raw
caveman
≈ one-third fewer output tokens — same technical content, less prose
● caveman · session 12.4k tok · ~$0.08 saved

Caveman trims Claude's wording down to the essentials, then a statusline reads the real per-session token counts from the transcript and prices them — so spend is visible while you work.

The security gates

.github/workflows/
pre-commit
Formatting & hygiene, before the code ever leaves your machine.
local
gitleaks
Blocks committed secrets, tokens, and keys.
secret-scan.yml
semgrep
SAST, including MITRE ATLAS rules for AI/ML risks.
semgrep.yml
Trivy
Scans the container image for known CVEs.
container-scan.yml
weekly audit
Scheduled repo-wide security sweep.
repository-audit.yml

Every gate is required, not advisory — a red check keeps the pull request from merging.

The loop

From idea to merge

One story, one branch, one pull request. The order is the point — each step gates the next.

Issue

Work is filed as a card on the board.

Route

Tagged Human, Claude, or Local by risk.

Claim

An agent picks it up — no collisions.

Pull request

Branch + PR that closes the issue.

Gates

Secrets, SAST, container scan must pass.

Merge

Reviewed, green, shipped.