What never goes in
Build-along · ~8 min at your own keyboard
The point of a workspace is that you stop deciding what to attach, because the folder is already the answer. That convenience is exactly the risk. Six months in you'll drag something into it on autopilot that carries an obligation you didn't think about at the moment of dragging. So the limit gets written down once, at the top, while you're still thinking clearly — and it's written as categories rather than instances, because you can't enumerate what hasn't arrived yet. This is separate from key and password hygiene, which is its own habit (B2 covers it). This is about material other people trusted you with.
The long version: What never goes in the workspace ↗
Do this
0/5Checkpoints
- ▸You should now see a NEVER IN THIS FOLDER block of three to five lines.
- ▸You should now see at least one line tied to a named obligation.
- ▸You should now see a file list you made yourself, read against your rule before any AI opened the folder.
- ▸You should now see the block at the very top of CLAUDE.md.
The three ways this goes wrong
- Your rules are vague ('no sensitive stuff'). — Name the obligation: the NDA, the contract clause, the platform term.
- The audit finds nothing. — Open each folder whose name you don't recognize. Folder names often hide a client.
- You file the block at the bottom. — Move it to the top, above every other section.
Share what happened
Paste your NEVER IN THIS FOLDER block and what the audit turned up — including nothing, if the answer was nothing.
Strip API keys, passwords, and tokens before you paste. Swap them for [KEY].
🔒 Don't paste confidential, personal-health, or payment info.