I'm the OP and wanted to clarify. We do not give Claude Code access to production API keys. The intent was staging databases and I've updated the post to make it more clear.

We assume that every API key we put into Claude Code can be leaked and therefore make sure there's nothing sensitive behind them.