[BUG] Claude Code can access denied files

Environment

• Platform (select one):
• [X] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• Claude CLI version: 1.0.63
• Operating System: macOS 15.5
• Terminal: Terminal App

Bug Description

I setup my .claude/settings.json to deny Read access to the credentials folder:

{
  "permissions": {
    "deny": [
      "Read(credentials/**)"
    ]
  }
}

However, Claude code is able to show me the contents of the file if asked.

<img width="681" height="439" alt="Image" src="https://github.com/user-attachments/assets/af5af320-f955-4cf4-b24f-c26656f3863d" />

Steps to Reproduce

1. Create secret file inside folder
2. Add rule to disallow access
3. Ask for contents of the file

Expected Behavior

Claude Code is blocked accessing the file. According to the documentation, this should deny access to all files inside the credentials folder.

<img width="714" height="212" alt="Image" src="https://github.com/user-attachments/assets/17ba4537-fc62-4382-ae60-8f4add61e16e" />

Actual Behavior

Claude Code prints out contents of file

Additional Context

I asked Claude Code, which mentioned that it could be due to total vs relative paths, but even adding **/credentials/** didn't work.