[BUG] Permission settings unclear/inconsistent - security issues
Status Fixed / completed
Maintainer reply ✓ Yes — rboyce-ant
Activity 5 comments · opened Jul 31, 2025 · closed Aug 1, 2025
💡 Likely answer: A maintainer (rboyce-ant, contributor)
responded on this thread — see the highlighted reply below.
Environment
- Platform (select one):
- [x] Anthropic API
- Claude CLI version: 1.0.64
- Operating System: macOS 15.5
- Terminal: Warp
Bug Description
The permission settings don't behave as expected. Several bash commands can be executed although denied through settings.
Steps to Reproduce
- Put these permission in ~/.claude/settings.json
"deny": [
"Read(.env)",
"Edit(.env)",
"Write(.env)",
"MultiEdit(.env)",
"Bash(*:.env)"
]- Instruct claude to cat your .env file.
- it will be able to do so
Expected Behavior
Permission denied
Actual Behavior
Permission not denied
Additional Context
I tried different syntax for \.env, .env\, .env - while the rules for Read, Edit, Write, etc seem to work, Bash seems to be just ignored.
5 Comments
Found 3 possible duplicate issues:
If your issue is a duplicate, please close it and 👍 the existing issue instead.
🤖 Generated with Claude Code
Maybe related but not really duplicates so I'll leave it open.
@Helmi Thanks for the feedback. We intentionally haven't allowed wildcards in Bash allow rules because the commands this would allow are very unsafe. For example,
*.envwould allowrm -rf / -- .envwhich is probably not what you intended when writing this rule! The documentation on how permission rules work is here: https://docs.anthropic.com/en/docs/claude-code/iam#tool-specific-permission-rules@rboyce-ant I get the general approach but my example isn't .env but :.env which in my mind would not allow any bash command on the .env file. I see why wild cards on the allow side of things would be problematic but on deny?
I think wildcards on the deny side should probably be safe?
Sidenote: If wildcards are disabled on intent for bash commands it might be worth putting it in the documentation?
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.