claude-code-guardrails/settings.json at main · benaiahbrown/claude-code-guardrails · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
{
  "permissions": {
    "deny": [
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/secrets/**)",
      "Read(**/.aws/**)",
      "Read(**/.ssh/**)",
      "Read(**/id_rsa*)",
      "Read(**/*_rsa)",
      "Read(**/*_dsa)",
      "Read(**/*_ed25519)",
      "Read(**/*key*)",
      "Read(**/*cert*)",
      "Read(**/*token*)",
      "Read(**/*secret*)",
      "Read(**/*credential*)",
      "Read(**/*password*)",
      "Read(**/.git/**)",
      "Read(**/.github/**)",
      "Write(**/.env)",
      "Write(**/.env.*)",
      "Write(**/secrets/**)",
      "Write(**/.aws/**)",
      "Write(**/.ssh/**)",
      "Bash(curl *)",
      "Bash(wget *)",
      "Bash(rm -rf *)",
      "Bash(git push*)",
      "WebFetch(*)",
      "WebSearch(*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/protect-files.sh"
          }
        ]
      },
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/validate-commands.sh"
          }
        ]
      }
    ],
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "$CLAUDE_PROJECT_DIR/.claude/hooks/run-safety-checks.sh"
          }
        ]
      }
    ]
  }
}