Claude Wiped Production .env: I Wrote a Guide to Stop It
FeralFancyBop · reddit · 2026-08-26
Following an incident where Claude Code wiped a production .env file, the author analyzes why standard permission rules (e.g., Bash(rm .env)) failed—due to path mismatches, command variants (like redirects), and content leaks. A two-layer defense strategy is proposed:
- Optimized Deny List: Covers Read/Edit of .env paths and common Bash variants, enforcing blocks even in bypass mode.
- PreToolUse Hook: Intercepts tool calls before permission evaluation, catching nested paths and keys in diffs. The author released an open-source tool, claude-code-guardrails.
This setup mitigates mistakes and casual prompt injection but is not a sandbox; direct file access via Python scripts remains a risk.
More from coding & agent
- Guiding AI to think outside the box improved translation speed by 42% — dotey · 2026-08-27
- Cursor Agent Ran 48 Hours Building a 3D Campus: More Detail, but Nearly Every Building Is Wrong — tristanbob · 2026-08-27
- Apodex 1.1 Report: Achieving Sustained, Verifiable Progress via Environment & Agentic Scaling — HeyAmit_ · 2026-08-27
- List features nearly 16 coding agents; how many does the world need? — thisiskp_ · 2026-08-27
- dhh Celebrates: GitHub Agents May Soon Stop Asking You to Drag Screenshots Manually — DanWahlin · 2026-08-27
- Clanker Cloud Allows Building Agents and Access via Curl — tekbog · 2026-08-27