Repository navigation
[BUG] Claude Code can access denied files #4768
Description
Environment
- Platform (select one):
- Anthropic API
- AWS Bedrock
- Google Vertex AI
- Claude CLI version: 1.0.63
- Operating System: macOS 15.5
- Terminal: Terminal App
Bug Description
I setup my .claude/settings.json to deny Read access to the credentials folder:
{
"permissions": {
"deny": [
"Read(credentials/**)"
]
}
}However, Claude code is able to show me the contents of the file if asked.
Steps to Reproduce
- Create secret file inside folder
- Add rule to disallow access
- Ask for contents of the file
Expected Behavior
Claude Code is blocked accessing the file. According to the documentation, this should deny access to all files inside the credentials folder.
Actual Behavior
Claude Code prints out contents of file
Additional Context
I asked Claude Code, which mentioned that it could be due to total vs relative paths, but even adding **/credentials/** didn't work.
Reacted by George Liu (eva2000), Raúl Santos, kikoking1, RiseAndCry, Ramses Romero Jr, prumand, Michael Volk, Mick Clarke (DataTorque), Nathan Woodhull, Adrian Stobbe and 1 more
Activity
dommueller commentedon Jul 30, 2025
It seems like this is related to using
@which invokes theRead <file>tool which is not bound by the rules ofRead(<file>). However, even if the user asks specifically for a file, I'm not sure it should be possible to read it if it is denied (e.g. by company policy).Furthermore, I have a feature request to disallow file paths independent of Tool. As currently Claude Code could just use
Bash(cat <file>)to get to the contents (or a variation of that).github-actions commentedon Aug 8, 2025
Found 3 possible duplicate issues:
This issue will be automatically closed as a duplicate in 3 days.
🤖 Generated with Claude Code
DollarAkshay commentedon Aug 8, 2025
To make things worse
Bash(*:*)orBash(*)which should disable all bash commands also doesnt work.github-actions commentedon Dec 3, 2025
This issue has been inactive for 30 days. If the issue is still occurring, please comment to let us know. Otherwise, this issue will be automatically closed in 30 days for housekeeping purposes.
shaken1901 commentedon Dec 4, 2025
Still observing this behavior in claude 2.0.58 as of today - please don't close this unassigned permissions issue via automation due to lack activity. It is important for trustworthiness that the permissions system behave as documented.
github-actions commentedon Jan 7, 2026
This issue has been automatically closed due to 60 days of inactivity. If you're still experiencing this issue, please open a new issue with updated information.
kozmic commentedon Jan 7, 2026
Please re-open this issue, as this is an important security control that is not working as documented.
github-actions commentedon Jan 17, 2026
This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.