Keep Claude Code away from your .env files with permission deny rules

Claude Code reads files to help you. That is great, until the file is .env, a private key, or a cloud credentials folder. Permission deny rules let you block those reads outright.

In .claude/settings.json (shared with the team) or settings.local.json (personal), add these entries under permissions.deny:

Deny rules win over allow rules, so even if you later allow broad Read access, these paths stay blocked.

Use deny for things that must never happen, ask for things like git push that need a human, and allow for safe everyday commands like npm test. I keep copy-ready Claude Code configs (CLAUDE.md templates, slash commands, hooks, permission rules) in Vildanden Agent Config. There is a free sample: https://justly-mia-429.rehost.page/