[BUG] Claude Code can access denied files

Status Closed — not planned

Maintainer reply None cached

Activity 8 comments · opened Jul 30, 2025 · closed Jan 7, 2026

Environment

Platform (select one):
[X] Anthropic API
[ ] AWS Bedrock
[ ] Google Vertex AI
Claude CLI version: 1.0.63
Operating System: macOS 15.5
Terminal: Terminal App

Bug Description

I setup my .claude/settings.json to deny Read access to the credentials folder:

{
  "permissions": {
    "deny": [
      "Read(credentials/**)"
    ]
  }
}

However, Claude code is able to show me the contents of the file if asked.

Steps to Reproduce

Create secret file inside folder
Add rule to disallow access
Ask for contents of the file

Expected Behavior

Claude Code is blocked accessing the file. According to the documentation, this should deny access to all files inside the credentials folder.

Actual Behavior

Claude Code prints out contents of file

Additional Context

I asked Claude Code, which mentioned that it could be due to total vs relative paths, but even adding **/credentials/** didn't work.

View original on GitHub ↗

8 Comments

dommueller · 1 year ago

It seems like this is related to using @ which invokes the Read <file> tool which is not bound by the rules of Read(<file>). However, even if the user asks specifically for a file, I'm not sure it should be possible to read it if it is denied (e.g. by company policy).

Furthermore, I have a feature request to disallow file paths independent of Tool. As currently Claude Code could just use Bash(cat <file>) to get to the contents (or a variation of that).

github-actions[bot] · 1 year ago

Found 3 possible duplicate issues:

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

DollarAkshay · 1 year ago

....As currently Claude Code could just use Bash(cat <file>) to get to the contents (or a variation of that).

To make things worse Bash(*:*) or Bash(*) which should disable all bash commands also doesnt work.

github-actions[bot] · 9 months ago

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

shaken1901 · 8 months ago

This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.

Still observing this behavior in claude 2.0.58 as of today - please don't close this unassigned permissions issue via automation due to lack activity. It is important for trustworthiness that the permissions system behave as documented.

github-actions[bot] · 7 months ago

This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.

kozmic · 7 months ago

Please re-open this issue, as this is an important security control that is not working as documented.