Stop Email Leaks Before They Happen: Blocking Email Addresses in Claude Code Prompts with Hooks

The Hidden Email Exposure Problem

Picture this: You're working with Claude Code and casually type:

"Send the project update to sarah.jones@company.com and ask about the deadline"

Without thinking, you just sent a real email address to an external AI service.

But here's the scary part: you just sent an email address, but it could have also been a SSN, credit card number, or any other sensitive data.

This happens more often than you'd think. Developers naturally include:

• Customer email addresses when describing bugs

• Team member emails when explaining workflows

• Client contact information in project discussions

• Real email addresses in example code or prompts

Even with the best intentions, email addresses slip into prompts and get transmitted to AI services. This creates privacy risks and potential compliance violations.

The Solution: Prompt-Level Privacy Protection

What if your AI assistant could automatically detect and block email addresses in your prompts before they ever leave your machine?

Claude Code hooks make this possible. By intercepting prompts at the source, we can create a local privacy safety net that prevents accidental email exposure.

How Prompt Protection Works

The protection works like this:

1. You type a prompt containing an email address

2. Claude Code intercepts it before sending to AI

3. Hook scans prompt content for email patterns

4. If emails found: Prompt blocked, never sent to AI

5. If no emails: Prompt proceeds normally

🚀 Master Claude Code Privacy & Security

Want to become an expert at protecting sensitive data in AI workflows? This email blocking technique is just one of dozens of powerful patterns covered in our comprehensive Claude Code training.

📚 Get the Complete Claude Code Book - Learn advanced hooks, security patterns, and enterprise AI workflows that protect your data while maximizing productivity.

🎓 Professional Training at claude-code-training.com - Hands-on courses covering everything from basic hooks to enterprise-grade AI governance systems.

Building the Email Protection Hook

Let's build a practical prompt hook that demonstrates this privacy protection.

Project Structure

blocking-emails-in-prompts/
├── .claude/
│   ├── settings.json                # Hook configuration
│   └── hooks/
│       └── prompt_email_blocker.py # Email detection hook
└── logs/
    └── prompt_blocker.json         # Hook execution logs

Hook Configuration

First, we configure Claude Code to intercept prompts in .claude/settings.json:

json

{
  "hooks": {
    "UserPromptSubmit": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "command",
            "command": "python3 .claude/hooks/prompt_email_blocker.py"
          }
        ]
      }
    ]
  }
}

The UserPromptSubmit event fires immediately when a user submits a prompt, before Claude processes it.

The Email Detection Logic

Our hook uses a simple regex to detect email addresses:

python

def detect_emails(content):
    """Detect email addresses in text content."""
    email_pattern = r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b'
    emails = re.findall(email_pattern, content, re.IGNORECASE)
    
    return {
        'has_emails': len(emails) > 0,
        'count': len(emails),
        'redacted_emails': [f"***@{email.split('@')[1]}" for email in emails[:3]]
    }

This pattern catches common email formats including:

• john.doe@company.com

• user123@example.org

• contact+sales@website.co.uk

The Blocking Mechanism

When emails are detected, the hook blocks the prompt with clear feedback:

python

if email_result['has_emails']:
    error_message = f"""
🚫 EMAIL ADDRESSES DETECTED IN PROMPT - BLOCKED

Found {email_result['count']} email address(es) in your prompt:
Examples: {', '.join(email_result['redacted_emails'])}

Your prompt contains email addresses and has been blocked to protect privacy.

To proceed:
1. Remove or redact the email addresses from your prompt
2. Use placeholder emails like 'user@example.com' instead
3. Replace emails with descriptions like '[team email]'

Privacy Protection: Your prompt was not sent to Claude.
"""
    
    print(error_message.strip(), file=sys.stderr)
    sys.exit(2)  # Exit code 2 blocks the prompt

Seeing It in Action

Dangerous Prompt: Contains Email 🚫

Input:

bash

claude "Send the project update to sarah.jones@company.com and let me know when it's done"

Result:

🚫 EMAIL ADDRESSES DETECTED IN PROMPT - BLOCKED

Found 1 email address(es) in your prompt:
Examples: ***@company.com

Your prompt contains email addresses and has been blocked to protect privacy.

To proceed:
1. Remove or redact the email addresses from your prompt
2. Use placeholder emails like 'user@example.com' instead
3. Replace emails with descriptions like '[team email]'

Privacy Protection: Your prompt was not sent to Claude.

Privacy Guarantees and Benefits

This approach provides comprehensive privacy protection:

✅ Complete Local Control

• All email detection happens on your machine

• No prompt content transmitted until cleared by hook

• You maintain complete control over your data

✅ Zero False Negatives

• Every prompt is checked - no caching issues

• Comprehensive regex catches email variations

• No timing or edge case problems

✅ Immediate Developer Feedback

• Clear explanation of why prompts were blocked

• Suggestions for safe alternatives

• Educational aspect improves prompting practices

✅ Perfect Audit Trail

• All hook executions logged with timestamps

• See exactly which prompts were blocked

• Complete compliance documentation

Real-World Applications

This prompt protection has immediate practical value:

Enterprise Development Teams

• Prevent developers from exposing customer emails in AI prompts

• Block internal team email addresses from external AI services

• Protect client contact information during problem-solving

Compliance and Regulatory

• GDPR compliance for EU email addresses

• Corporate data protection policy enforcement

• SOX compliance for financial services communications

Security Best Practices

• Train developers on safe AI prompt engineering

• Prevent PII from entering AI training data

• Secure development workflow implementation

Conclusion

Email addresses don't have to slip into your AI prompts anymore. With a simple Claude Code hook, you can create a local privacy safety net that catches email addresses before they ever leave your machine.

This represents a fundamental shift toward privacy-first AI development - where we build protective systems locally instead of hoping external services will protect our data.

The best part? This solution is:

• 100% Local - No external dependencies

• Always Active - Works on every single prompt

• Completely Transparent - You see exactly what was blocked

• Developer-Friendly - Clear feedback improves practices

Privacy protection doesn't have to be complicated. Sometimes the most effective solutions are the simplest ones that run right where you need them - at the source.

🚀 Get the Full Tutorial Source Code

📚 Github Repository: xoself/blocking-emails-with-cc-hooks

🚀 Master Claude Code Privacy & Security

Want to become an expert at protecting sensitive data in AI workflows? This email blocking technique is just one of dozens of powerful patterns covered in our comprehensive Claude Code training.

📚 Get the Complete Claude Code Book - Learn advanced hooks, security patterns, and enterprise AI workflows that protect your data while maximizing productivity.

🎓 Professional Training at claude-code-training.com - Hands-on courses covering everything from basic hooks to enterprise-grade AI governance systems.

Transform your team's AI development practices with battle-tested privacy protection techniques.

https://claude-code-training.com