25 lines
887 B
JSON
25 lines
887 B
JSON
{
|
|
"//": "Project-scoped Claude Code settings. See CLAUDE.md and docs/WORK_CYCLE.md.",
|
|
"permissions": {
|
|
"//deny": [
|
|
"Deny wins over allow. Paths use the DOUBLE-SLASH absolute form -- a",
|
|
"tilde-style rule looks right in review and silently matches nothing,",
|
|
"which is indistinguishable from a rule that works until it matters.",
|
|
"",
|
|
"This closes the Read TOOL only. A shell can read a file a hundred ways,",
|
|
"so this catches the accidental read, not the determined one. The real",
|
|
"protection is having a sanctioned reader that answers the question",
|
|
"without returning the value -- see CLAUDE.md."
|
|
],
|
|
"deny": [
|
|
"Read(//**/.env)",
|
|
"Read(//**/.env.*)",
|
|
"Read(//**/*.token)",
|
|
"Read(//**/*.pem)",
|
|
"Read(//**/id_rsa*)",
|
|
"Read(//**/credentials/**)",
|
|
"Read(//**/secrets/**)"
|
|
]
|
|
}
|
|
}
|