PulseAugur
EN
LIVE 10:41:51

Claude Code user details security near-miss with broad permissions

A developer shared their experience with Claude Code's permission settings, highlighting a near-miss where overly broad allow-list entries permitted dangerous commands like `git push` and `git reset --hard`. They discovered that the `*` wildcard in `Bash(git *)` matched more than intended, and that multiple settings files with varying priorities could override configurations. To prevent future issues, the developer implemented a layered approach to their `settings.json` file, prioritizing user-wide safe defaults and using project-specific files for domain allow-lists and experimental settings. AI

IMPACT Developers using AI coding assistants should carefully configure permissions to prevent unintended access to sensitive commands and files.

RANK_REASON User-level configuration advice for an AI coding assistant.

Read on dev.to — Claude Code tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

COVERAGE [1]

  1. dev.to — Claude Code tag TIER_1 English(EN) · Rapls ·

    The lines I add to Claude Code's settings.json after one near-miss

    <p>I was running Claude Code on a WordPress plugin repo and got tired of approving git commands one by one. So, without much thought, I dropped <code>Bash(git *)</code> into my allow list. "Git stuff goes through quietly now," about that level of care. I build <a href="https://ra…