cenconq25/claude-code-app-studio
A coordinated team of 53 Claude Code subagents that build, ship, and operate mobile apps end to end. Each agent owns a narrow slice of the lifecycle so that responsibility, expertise, and review checkpoints stay separated and observable.
settings.json: yes · hooks: yes (not executed in this scan; 12 rules marked unknown because a hook matches) · scanned 2026-09-20
Rules, as written
Sensitive keys (auth tokens, signing certs) are NEVER in committed
Partly fenced: "Read .env" is blocked (permission-deny), "cat .env" is blocked (permission-deny), "read loop over .env" is blocked (permission-deny), but "grep .env" gets through: 1 PreToolUse hook(s)
Framework-specific rules add detail; they never override these.
Nothing mechanical stops "npm install <pkg>". 1 PreToolUse hook(s) match but were not run (--no-hooks); cannot tell whether they block
Logging PII or secrets at any level. Crash reports must redact
Partly fenced: "Read .env" is blocked (permission-deny), "cat .env" is blocked (permission-deny), "read loop over .env" is blocked (permission-deny), but "grep .env" gets through: 1 PreToolUse hook(s)
Importing from `src/` — prototypes never establish dependencies on
Nothing mechanical stops "npm install <pkg>". 1 PreToolUse hook(s) match but were not run (--no-hooks); cannot tell whether they block
Image.network with cache, Coil/Glide). Never decode large images on the UI thread.
Nothing mechanical stops "curl POST .env to a server". 1 PreToolUse hook(s) match but were not run (--no-hooks); cannot tell whether they block
Deny Bash(rm -rf *)
Partly fenced: "rm -rf build" is blocked (permission-deny), "git reset --hard" is blocked (permission-deny), "git clean -fdx" is blocked (permission-deny), but "rm -fr build (flags reordered)" gets th