Claude Wiped Production .env: I Wrote a Guide to Stop It
FeralFancyBop · reddit · 2026-08-26
Following an incident where Claude Code wiped a production .env file, the author analyzes why standard permission rules (e.g., Bash(rm .env)) failed—due to path mismatches, command variants (like redirects), and content leaks. A two-layer defense strategy is proposed:
- Optimized Deny List: Covers Read/Edit of .env paths and common Bash variants, enforcing blocks even in bypass mode.
- PreToolUse Hook: Intercepts tool calls before permission evaluation, catching nested paths and keys in diffs. The author released an open-source tool, claude-code-guardrails.
This setup mitigates mistakes and casual prompt injection but is not a sandbox; direct file access via Python scripts remains a risk.
More from coding & agent
- Kimi Releases Workflow Tutorial #3: Swarm, Plugins and Local Project Sync — Kimi_Moonshot · 2026-10-15
- Dev bills $20,000 for an app built with $200 of Claude Code — IgorCarron · 2026-10-15
- Dan Shipper: run product and labs in parallel, even with a labs team of one — danshipper · 2026-10-15
- Gemini 4 Argon wrote 5,000+ lines of pure Python to build its own ray-tracing 3D engine — aitrendz_xyz · 2026-10-15
- Minecraft fully ported from Java to Rust, file by file, server and client included — Vjeux · 2026-10-15
- mitsuhiko builds a full Python IDE for iOS in an afternoon with new AI models — mitsuhiko · 2026-10-15