If I am not mistaken, Claude sometimes pulls an API key out of a .env file and drops it into that folder. It might be neat for you to add a feautre specifically for identifying any keys that are in that folder.