PRODUCTION SCENARIO
A repository contains a .env file with database credentials. Engineers want Claude Code's file tools blocked from reading it in every session on that project.
Which permission rule accomplishes this?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A deny rule Read(./.env) in the project's settings
A Read deny rule is what the docs prescribe: deny beats allow, it also blocks Edit and Write on the same path, and it covers the file commands Claude Code recognises in Bash such as cat and head. An Edit deny rule is consulted but governs changes, not reads. The Bash rule closes one command spelling and leaves the Read tool open. Claude Code consults only Read and Edit path rules, so a Write path rule is accepted, never checked, and flagged at startup.
Official Source: https://code.claude.com/docs/en/permissions ↗