Critical Security Bug: `deny` permissions in `settings.json` are not enforced**

Another earlier report: https://github.com/anthropics/claude-code/issues/6631

If you're implementing this security fix at the home directory level (rather than per-project), you need to update the path in ~/.claude/settings.json:

"hooks": {
  "PreToolUse": [
    {
      "matcher": "Read|Edit|MultiEdit|Write",
      "hooks": [
        {
          "type": "command",
          "command": "~/.claude/hooks/protect_sensitive_files.py"
        }
      ]
    }
  ]
}

Important notes:

• Use ~/.claude/hooks/protect_sensitive_files.py (tilde notation works)
• Don't use $HOME/.claude/hooks/protect_sensitive_files.py (environment variables aren't expanded in JSON)
• The absolute path /home/username/.claude/hooks/protect_sensitive_files.py also works but is less portable

This applies the security hooks globally for all your Claude Code projects, rather than having to configure it per-project.

I asked Claude Code to extend the script to read the denials from settings.json. This should behave the same as expected behavior:
Since I'm using NixOS, I've modified the shebang. Feel free to change it to #!/usr/bin/env python3.

#!/usr/bin/env nix
#! nix shell nixpkgs#python3 --command python3
import sys
import json
import os
from pathlib import Path
from fnmatch import fnmatch

def load_settings():
    """Load Claude settings and extract deny patterns."""
    settings_path = Path.home() / '.claude' / 'settings.json'
    try:
        with open(settings_path) as f:
            settings = json.load(f)
            deny_patterns = settings.get('permissions', {}).get('deny', [])
            return deny_patterns
    except (FileNotFoundError, json.JSONDecodeError, KeyError):
        return []

def extract_path_pattern(deny_rule):
    """Extract file path pattern from deny rule like 'Read(./path/pattern)'."""
    if deny_rule.startswith('Read(') and deny_rule.endswith(')'):
        return deny_rule[5:-1]  # Remove 'Read(' and ')'
    return None

def matches_pattern(file_path, pattern):
    """Check if file path matches a deny pattern."""
    file_path = str(file_path)
    
    # Convert relative patterns to work with absolute paths
    if pattern.startswith('./'):
        # For patterns like './local/**', check if any part of the path matches
        pattern = pattern[2:]  # Remove './'
        # Check if the pattern matches any suffix of the path
        path_parts = file_path.split('/')
        for i in range(len(path_parts)):
            partial_path = '/'.join(path_parts[i:])
            if fnmatch(partial_path, pattern):
                return True
    else:
        # Direct pattern matching
        if fnmatch(file_path, pattern):
            return True
    
    return False

def main():
    """
    Main function to process the hook input and check for sensitive file access.
    """
    try:
        # Read the JSON data passed from Claude Code via stdin
        data = json.load(sys.stdin)
        tool_input = data.get('tool_input', {})
        file_path_str = tool_input.get('file_path')

        if not file_path_str:
            # If no file path is involved, the hook doesn't need to act.
            sys.exit(0)

        file_path = Path(file_path_str)
        
        # Load deny patterns from settings
        deny_rules = load_settings()
        
        # Check if the file path matches any deny pattern
        for rule in deny_rules:
            pattern = extract_path_pattern(rule)
            if pattern and matches_pattern(file_path, pattern):
                # Construct a clear, educational error message for the LLM
                error_message = (
                    f"SECURITY_POLICY_VIOLATION: Access to '{file_path}' is blocked by deny rule: {rule}\n"
                    f"Reason: This file matches a pattern in your Claude settings.json deny list.\n"
                    "Action: Files in denied paths contain sensitive information and should not be accessed by the AI."
                )
                
                # Print the error message to stderr
                print(error_message, file=sys.stderr)
                
                # Exit with code 2 to block the tool and feed stderr back to Claude
                sys.exit(2)

    except (json.JSONDecodeError, KeyError) as e:
        # Handle potential errors in the input data
        print(f"Error processing hook input: {e}", file=sys.stderr)
        # Exit with a non-blocking error code
        sys.exit(1)

    # If no sensitive file was detected, exit with 0 to allow the action
    sys.exit(0)

if __name__ == "__main__":
    main()

@xdevs23, wow, this is fantastic. Thanks for building on this.

This is a brilliant evolution of the workaround. Having it read the deny rules directly from settings.json is exactly the right move—it effectively polyfills the broken functionality and makes the hook a true drop-in replacement. Your implementation looks solid.

Appreciate the note on the NixOS shebang as well; good call-out for users on different distros.

This is an excellent stop-gap for the community.

Great contribution

@coygeek I appreciate it.

If Claude Code was open source we could simply let Claude Code implement the feature using this example.
Now we have to rely on the Claude Code developers to use Claude Code to code the Claude Code feature using the Claude Code hook mentioned above 😂

If this was open source, a security vulnerability like this would be fixed in a minute.

Thank you for the detailed report and the helpful hook workaround! I've investigated this issue and found that the deny rules are likely not working due to a common but understandable confusion about pattern syntax. The pattern Read(./.env) in your example is interpreted as relative to the current working directory where you run claude, not relative to your project or settings file location. This is why the deny rule isn't matching.

See https://docs.anthropic.com/en/docs/claude-code/iam#tool-specific-permission-rules. Claude Code supports four different pattern types for file paths:

| Pattern | Meaning | Example | What it matches |
|---------|---------|---------|-----------------|
| //path | Absolute path from filesystem root | Read(//.env) | /.env (root of filesystem) |
| ~/path | Path from home directory | Read(~/.env) | /Users/you/.env |
| /path | Path relative to settings file directory | Read(/.env) | <project>/.env |
| path or ./path | Path relative to current working directory | Read(.env) or Read(./.env) | <cwd>/.env |

To block .env files in your project, you should use:

{
  "permissions": {
    "deny": [
      "Read(/.env)",      // Blocks <project>/.env (relative to settings file)
      "Read(/**/.env)"    // Blocks any .env file in project subdirectories
    ]
  }
}

Make sure you're editing .claude/settings.json in your project root, not the global user settings.

Please let me know if the corrected pattern syntax resolves the issue. If not, there may indeed be a bug that needs further investigation.

@bogini But in my case I have:

      "Read(./.env.local)",
      "Read(./local/**)",
      "Read(./secrets/**)",
      "Read(./local-data/**)"

And I did run claude code from the directory that contains "local" and it still read the files inside of it.

Thanks for the response @bogini

I'm on v1.0.100, and I've just re-tested the following:

Read(~/.env) => Blocks /Users/user/.env

Read(/.env) => Blocks <project>/.env
Read(/**/.env) => Blocks any .env file in project subdirectories (so for example <project>/src/.env)

Read(.env) => Blocks <cwd>/.env
Read(./.env) => Blocks <cwd>/.env

It's working as intended / normally.

I suggest updating both settings and iam documentation to be more clear of all variations / examples.

I'll leave this open, in case someone needs to contribute, but this appears to be resolved for me.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.