Add a deny rule for your env files in the agent's permission settings, enable the sandbox so the block holds for every process, and avoid keeping long-lived production keys on the laptop at all. Deny rules cover the agent's file tools, but not every way a script can read a file.
Step 1: add deny rules
In Claude Code, permission rules are evaluated in the order deny, ask, allow, and the first match decides the outcome. An allow rule cannot carve an exception out of a deny rule. A Read deny rule blocks reading the named path, and it also blocks the Edit and Write tools on that path.
{
"permissions": {
"deny": ["Read(.env)", "Read(.env.*)", "Read(./secrets/**)"]
}
}
A bare filename follows gitignore style matching, so Read(.env) matches an .env at any depth under the current directory. It does not block an .env in a parent directory or a different project, so add user level rules for paths you care about everywhere.
Step 2: know the limit
The documentation says Read and Edit deny rules apply to built-in file tools and to file commands it recognizes in Bash, such as cat and head. They do not apply to commands that read files without naming them, or to scripts that open files themselves. A Python one-liner could still read the file.
Step 3: enable the sandbox
For enforcement that blocks all processes from a path, the documentation points to the sandbox. This is the control that closes the gap in step 2. Pair it with a network allowlist so nothing it reads can be sent to an arbitrary host.
Step 4: put the rules in managed settings
Rules in a personal file protect one developer. Managed settings let administrators distribute rules that users cannot override, and the same documentation describes settings that disable bypass modes. Push the baseline from there.
Step 5: shrink what is there to read
| Practice | Benefit |
|---|---|
| Use a secrets manager and load values at run time | No file to read |
| Use short-lived tokens | A leaked token expires |
| Keep production keys off developer machines | Limits the blast radius |
| Commit an example file with fake values | Documents needed variables safely |
Try it yourself
Click through it at your own pace, or open it full screen.
Follow the setup flow and notice where tool access is scoped, since the same idea applies to files.
Quick check
Does a .claudeignore file work?
The Claude Code documentation says a .claudeignore file has no effect and tells you to move entries into Read deny rules.
Is a deny rule a security boundary?
On its own, no. The documentation says rules cover the usual invocation and recommends the sandbox for hard enforcement.
Safeguard provides MCP Guardrail and agent identity so agent tool access can be scoped and traced, and a free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
