是否给予 Claude Code 对我自托管安装的只读访问权限？

支持 安装
1

I have Claude Code and I’d like to make the best use possible of it to assist me in setting up and managing my install. I do not want to give it any kind of write access. Is there a way to give it SSH access to my Discourse install with only read permissions? Same with the database? And to forbid access to anything “security/confidential” on the server? Seems to me it would be much more efficient if I can give it this kind of access, rather than have it read web pages, dig through SQL dumps (btw, come to think of it: do those contain anything sensitive security-wise? I imagine they do), give it screenshots or copy-paste settings and error messages…

Is anybody doing this kind of thing?

2

可以，你可以创建一个仅具有只读权限的 SSH 用户，并让 Claude Code 使用该用户……这样能防止未经授权的修改，但它仍然能够读取敏感信息。

你的推测是正确的！个人消息的内容、哈希密码、IP 地址、API 密钥等等，包含大量敏感信息。

更简单的做法是创建一个不含敏感数据但配置相同的网站副本，将其用作沙箱。这样做也有权衡之处，因为你需要维护一个独立的网站并保持配置同步，而且有时你只能在生产环境中复现问题。不过，这是最安全的方式。

你保持谨慎是对的……我们 Discourse 团队自身的安全政策也对此加以限制，我们不能让大型语言模型访问生产数据库。