Starter template

Claude Code safe settings.json: deny .env reads and git push

A ready settings.json for Claude Code: allow lint and tests, ask before commits, deny reading .env files, git push and rm -rf. Schema-validated.

· By Codema Editorial

Free account required
Download

Deny rules block in every permission mode, even bypassPermissions. Rules are checked deny, then ask, then allow.

Preview: settings.json

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)",
      "Bash(npm run build)",
      "Bash(git status)",
      "Bash(git diff *)"
    ],
    "ask": [
      "Bash(git commit *)",
      "Bash(npm install *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./**/.env)",
      "Read(./**/.env.*)",
      "Edit(./.env)",
      "Edit(./.env.*)",
      "Bash(git push *)",
      "Bash(rm -rf *)",
      "Bash(supabase db reset *)"
    ]
  }
}

What's inside

  • allow: lint, tests, build, git status and diff
  • ask: commits and installs
  • deny: .env reads and edits, git push, rm -rf, supabase db reset

How to use it

  1. Save as .claude/settings.json in your project root.
  2. Edit the npm commands to match your package.json.
  3. Commit it so your team gets the same rules.
  4. Personal tweaks go in .claude/settings.local.json.

Who it's for

Anyone running Claude Code in a repo with real secrets.

Keep reading

Keep reading

Newsletter

The Codema publication. Consent is required. You are not subscribed until you confirm from the email, and nothing is stored if email delivery is not connected.