claude-obsidian

Least-privilege permissions

• Store Claude API keys in environment variables only (.env file with strict 600 permissions); never hardcode or commit to version control.
• Run the claude-obsidian process with a dedicated low-privilege OS user account that has read/write access only to your Obsidian vault directory, not system binaries or other user data.
• Audit file-access patterns in the codebase; ensure the agent cannot recursively read parent directories or follow symlinks outside your vault boundary.
• Configure Claude API calls with minimal token budgets and rate-limiting to reduce blast radius if credentials are compromised.

Network isolation

• Route Claude API traffic through a firewall rule that explicitly allows only api.anthropic.com; block or log all other outbound HTTPS connections from the process.
• Consider running claude-obsidian in a container (Docker/OCI) with no internet access except a tightly scoped proxy, if handling highly sensitive vault content.
• Disable clipboard and clipboard-sync features if available; require explicit file-path arguments rather than dynamic sources that could be intercepted.
• Inspect HTTP/HTTPS logs for unintended exfiltration; monitor for API calls to domains other than Anthropic's official endpoints.

Monitoring

• Log all file I/O operations (reads, writes, deletions) within the vault; correlate timestamps with Claude API call logs to detect anomalies.
• Track Claude API request tokens, response tokens, and latency; alert on unusually large context windows or unusual prompt patterns that may indicate injection attacks.
• Enable debug logging temporarily to capture full prompts and responses; review for sensitive data leakage (passwords, PII, API keys) before disabling.
• Set up alerts for failed authentication attempts, rate-limit hits, and unauthorized file-access errors in application and OS logs.

Red flags to watch for

• Prompt outputs that reference or echo back vault content you did not explicitly request; indicates potential injection or unintended context leakage.
• Dropped files that contain unusual encoding, escape sequences, or multi-language Unicode that could bypass prompt sanitization.
• API errors or retries with gradually increasing latency; may signal reconnaissance attempts or token-limit probing by injected prompts.
• Long periods without maintainer commits, unresponded security issues, or frequent dependency updates without changelogs; assess active support before upgrading.