To use Claude Cowork and Claude Code safely, add six guardrails: make Claude read every file back after saving it, keep a backup you check, never treat a sync as a backup, put code in git, keep secrets in a .env file, and keep approvals on for anything that deletes, deploys or sends.
I run my business and my life on Claude every day, across both tools. These are the rules I'd keep if I could only keep a few. Most of them exist because something went wrong without them.
1. Verified writes
"Saved" on screen is not proof. After every save, Claude should read the file back from disk and check it matches. If it doesn't, it tries again, then tells you plainly.
One line in each CLAUDE.md does it:
- After saving a file, read it back from disk and check it matches
before saying it's done. If it doesn't match, try again, then tell me plainly.
It costs a few seconds per save. The day it catches a bad write, you'll know about it then rather than a week later.
2. Backups you check
One master copy, plus a daily backup somewhere else. Then make the backup visible. Have each Cowork session check the backup's last-run date and say so if it's more than a day old.
- At the start of every session, check the date of the newest backup
of this folder. If it's more than a day old, tell me before anything else.
A backup nobody checks can stop without anyone noticing. Mine once did.
3. A sync is not a backup
A two-way sync copies mistakes as faithfully as good changes. If you delete or overwrite something on one side, the sync dutifully does the same on the other.
On 3 October a sync put older copies of five of my documents back over newer ones, including my website's privacy policy and terms. Nothing showed an error. I noticed eight days later. The full story is in Claude Cowork vs Claude Code: how to use both together.
What fixes it:
- If a folder is shared, only one side writes each file.
- The sync should refuse to bring down a file older than yours, or keep what it replaces in a dated folder first.
- Check your important files again after any sync, not only when you save them.
4. Git for code
Commit before a big change. Claude Code works on a branch, shows you the change running locally, and doesn't push or deploy without asking.
- Work on a branch. Commit before a big change.
- Show me the change running locally before committing.
- Never push or deploy without asking.
Git is the undo button for code. Without it, "Claude changed something and now it's broken" has no easy way back.
5. Secrets stay in .env
API keys live in a .env file that git ignores. Never in CLAUDE.md, notes or screenshots.
# .gitignore
.env
.env.*
!.env.example
Keep a .env.example with the names only, so anyone setting up the project knows which keys it needs without seeing a single value. Notes files get synced, shared and pasted into chats. A key that lands in one has effectively left the building.
6. Approvals for anything you can't undo
Keep the setting that asks you first for anything that deletes, deploys or sends. Cowork already asks before it permanently deletes a file. Read the prompt before you press Allow, especially in your first weeks.
The rule of thumb I use: if I couldn't undo it in a minute, I want to approve it.
Get the checklist
All six are in the guardrails checklist inside the part 2 Life OS kit, alongside the CLAUDE.md templates that carry these lines. If you haven't set up a Life OS folder yet, start with How to set up Claude Cowork as a second brain.
Questions people ask
What is a verified write?
After saving a file, Claude reads it back from disk and checks it matches before saying it's done. One line in CLAUDE.md turns it on.
Is OneDrive, Dropbox or iCloud a backup?
Not on its own. A two-way sync copies mistakes as faithfully as good changes. Keep a separate backup and check that it ran.
Can Claude Code push or deploy without asking?
It can if you let it. Put "never push or deploy without asking" in the project's CLAUDE.md and keep approvals on for those actions.
Where should API keys go when using Claude Code?
In a .env file listed in .gitignore. Never in CLAUDE.md, notes files or screenshots.
Does Cowork delete files without asking?
Cowork asks for your permission before permanently deleting files. Keep a backup anyway, and have Claude move old files to an Archive folder instead of deleting them.
Want these set up for you?
The lines above are yours to copy. Start with the first two today. They take about five minutes.
If you'd rather have it set up with you, on your own tools, book a free intro call.