To stop Claude Code from reading secret files, add Read deny rules for their paths to your settings, such as one for .env and one for a secrets folder. The rule applies to built-in file tools and to recognized file commands in Bash. It is not a full boundary, so pair it with the sandbox.
The rule
Anthropic's permissions documentation says to add a Read deny rule for the path, for example Read(./.env) or Read(./secrets/**). In settings it looks like this:
{
"permissions": {
"deny": [
"Read(./.env)",
"Read(./secrets/**)"
]
}
}
Bare filenames follow gitignore semantics. The docs state that Read(.env) and Read(**/.env) are equivalent and block any .env at or under the current directory, but not one in a parent directory or another project.
Gotchas from the docs
- A
.claudeignorefile has no effect. If your project has one, move its entries into Read deny rules. - A Read deny rule also blocks the Edit and Write tools on the same path, including creating a new file there. NotebookEdit is not covered, so add an Edit deny rule for paths no tool may change.
- Path rules are anchored. A rule written as
Read(/secrets/**)in user settings blocks a folder under~/.claude, not asecretsdirectory in your project. In user settings, use a double-slash absolute path or a home-relative path to cover every project. - Deny rules apply when either the requested path or the file it resolves to matches, so a symlink pointing at a denied file is denied too.
What the rule does not cover
The documentation says Read and Edit deny rules apply to the built-in file tools, to file commands Claude Code recognizes in Bash such as cat, head, tail, sed and tee, and to the targets of redirections. They do not apply to a command that reads files without naming them, such as a recursive grep run from the folder that holds the file.
So the rule reduces accidents but is not containment. A process that runs under your user account can still read what your account can read.
Layer it with the sandbox
Claude Code also has an OS level sandbox for shell commands, with filesystem and network isolation. It covers shell commands only, and the docs describe it as separate from permission rules. Use both: deny rules for clear intent, the sandbox for enforcement.
And keep secrets out of the repo
The simplest control is not having live credentials on the developer machine. Use short-lived credentials, load secrets from a manager at run time, and rotate anything an agent might have seen.
Quick check
Will a .claudeignore file hide files from Claude Code?
No. The documentation says it has no effect. Use Read deny rules.
Does a Read deny rule stop a recursive grep from the same folder?
Not reliably. The docs say it does not apply to commands that read files without naming them. Use the sandbox as well.
Sources
Last reviewed: 19 October 2026.
