From 6a7a6d9144fce55ef6850a1f63274bba548b2e8b Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Thu, 3 Sep 2026 22:40:34 +0000
Subject: [PATCH] chore: stop denying reads of secret files in claude settings
 (#10968)

Any Read() deny rule makes Claude Code resolve the file operands of every
Bash command that reads files. A path it cannot resolve, such as one that
follows a cd into a directory the analyzer does not track, escalates to a
permission prompt even under bypassPermissions. A plain recursive grep in
the repo root escalates too, because it could reach .env.

Drop the read rules and widen the write rules to cover the same files, so
secrets still cannot be written through Edit, Write, or a shell redirect.
Reads of those files are no longer blocked.


Claude-Session: https://claude.ai/code/session_01RNCupPk2yewQT1JMNjkV8M

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .claude/settings.json | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/.claude/settings.json b/.claude/settings.json
index a464ca3719..37aaeeb0f5 100644
--- a/.claude/settings.json
+++ b/.claude/settings.json
@@ -55,22 +55,18 @@
       "mcp__claude_ai_Gmail__list_drafts"
     ],
     "deny": [
-      "Read(.env)",
-      "Read(.env.*)",
-      "Read(**/.env)",
-      "Read(**/.env.*)",
-      "Read(**/secrets/**)",
-      "Read(**/*.pem)",
-      "Read(**/*.key)",
-      "Read(**/credentials.json)",
-      "Read(**/.secret*)",
-      "Read(**/.secrets*)",
-      "Read(**/*.secret)",
-      "Read(**/*.secrets)",
       "Edit(.env)",
       "Edit(.env.*)",
       "Edit(**/.env)",
-      "Edit(**/.env.*)"
+      "Edit(**/.env.*)",
+      "Edit(**/secrets/**)",
+      "Edit(**/*.pem)",
+      "Edit(**/*.key)",
+      "Edit(**/credentials.json)",
+      "Edit(**/.secret*)",
+      "Edit(**/.secrets*)",
+      "Edit(**/*.secret)",
+      "Edit(**/*.secrets)"
     ],
     "ask": [
       "Bash(rmdir:*)",