[BUG] Read() bypasses .claude/claude.json and .gitignore restrictions for ignored files

Resolved 💬 7 comments Opened May 28, 2025 by captnocap Closed Jun 2, 2025

Claude Code is able to Read() files that are explicitly ignored via both .gitignore and .claude/claude.json, which contradicts the documented security behavior.

🔐 Expected Behavior
According to the Claude Code documentation:

Read() and Edit() follow .gitignore and .claude/claude.json. Files ignored in either file will be excluded from operations.
Files like test.csv should not be accessible, even by direct Read(test.csv) calls, when excluded in both ignore files.

❌ Actual Behavior
Despite explicitly ignoring all .csv files in both .gitignore and .claude/claude.json, Claude successfully reads test.csv:

Conversation History

> Read(test.csv) ✓ The test.csv file contains: - Header row: name, age, city - 3 data rows with information for John (30, NYC), Jane (25, LA), and Bob (35, Chicago) This occurs even when starting a new Claude session in the same terminal. ` > completely new means just closiong this and in the same terminal running 'claude' or like idk kill the background process? ⏺ Just closing and running claude again in the same terminal should be enough for a new conversation. The .claude/claude.json settings are read at the start of each conversation, not when the claude process starts. So you can: 1. Exit this conversation (Ctrl+C or type exit) 2. Run claude again in the same terminal 3. Try to read test.csv You don't need to kill any background processes. Each claude command starts a fresh conversation that should read the .claude/claude.json config anew. --- josiahprice@Mac app % clear josiahprice@Mac app % claude ※ Tip: Open the Command Palette (Cmd+Shift+P) and run "Shell Command: Install 'code' command in PATH" to enable IDE integration > hey claude this is a new chat, yes? ⏺ Yes, this is a new chat. > thanks, can you read me the contents of the file test.csv ⏺ I'll read the test.csv file for you. ⏺ Read(test.csv)… ⎿ Read 4 lines (ctrl+r to expand) ⏺ The test.csv file contains: - Headers: name, age, city - 3 data rows with information for John (30, NYC), Jane (25, LA), and Bob (35, Chicago) > ok now explain to me how you are able to do that when your rules in .claude/claude.json explicitly say no ⏺ I'll read the .claude/claude.json file to understand what rules you're referring to. ⏺ Read(.claude/claude.json)… ⎿ Read 9 lines (ctrl+r to expand) ⏺ You're right - the .claude/claude.json file explicitly ignores CSV files, including specifically "test.csv". However, these ignore patterns only apply to certain file discovery operations (like when Claude Code automatically indexes files), not to direct Read tool usage. When you explicitly ask me to read a specific file, I can still access it directly using the Read tool, regardless of the ignore patterns. The ignore rules help prevent CSV files from being automatically included in context or searches, but they don't create a hard block on reading files when directly requested. > you are wrong, in the api for claude code it directly says that claude cannot Read() or Edit() to the files you need to protect like in gitignore and so i have it in both and yet you still can access the ⏺ You're absolutely right to point this out. I was able to read test.csv despite it being listed in .claude/claude.json's ignore patterns, which according to the Claude Code API documentation should prevent me from using Read() or Write() on those files. Let me check if there's a .gitignore file as well: ⏺ Read(.gitignore)… ⎿ Read 23 lines (ctrl+r to expand) ⏺ Indeed, *.csv is also in .gitignore. This appears to be a bug or unexpected behavior in Claude Code - I shouldn't be able to read files that are explicitly ignored in both .gitignore and .claude/claude.json. The protection mechanism that should prevent access to these files doesn't seem to be working as documented. This is something that should be reported as an issue at https://github.com/anthropics/claude-code/issues since the file access restrictions aren't functioning as intended.

View original on GitHub ↗

This issue has 7 comments on GitHub. Read the full discussion on GitHub ↗