relay/last-context.md is committed to git. Do not write the following into it:
- Passwords, API keys, tokens, secrets of any kind
- Personal identification information (real names, addresses, phone numbers)
- Confidential business data you are not authorized to share
The relay file is for task state and work context — not credentials.
Use environment variables (.env) for any secrets needed by the hooks.
| Component | Status |
|---|---|
| scripts/hooks/pre-compact.js | Maintained |
| scripts/telegram/context-hook.js | Maintained |
| relay protocol (CLAUDE.md + last-context.md) | Stable — no security surface |
If you find a security issue in the hook scripts or setup tooling:
- Do not open a public issue.
- Open a GitHub Security Advisory on this repository.
- Describe the issue, affected file, and potential impact.
Expected response time: within 7 days.
In scope: hook scripts, setup script, .env handling, settings template.
Out of scope: Claude Code itself, Telegram API, git hosting providers.