PRODUCTION SCENARIO
A repository contains a .env file with database credentials. Engineers want Claude Code's file tools to be blocked from reading it in every session on that project.
Which permission rule accomplishes this?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A deny rule Read(./.env) in the project's settings
Blocking file tools from reading a path takes a Read deny rule for that path, and deny rules cannot be overridden by an allow rule. A Write rule is never consulted for a read, and a Bash rule only closes the shell route to the file.
Official Source: https://code.claude.com/docs/en/permissions ↗