Permissions
3 articles
-
Claude CodeClaude Code's Allow Rule Is the Whole Command, Password Included
Apiiro found 2,539 real secrets in 1,994 public GitHub repos, most of them in .claude/settings.local.json, the file Claude Code writes when you pick "Yes, and don't ask again". On 2.1.319 the rule it saves is the full command string, PGPASSWORD= and bearer header included, with no prefix and no redaction. Claude Code keeps the file out of git with one line in the global excludes file in your home directory, not the repo, so a clone elsewhere stages it with git add -A, and once the file is tracked the exclude does nothing. When the file is already committed, Claude Code notices and prints that it is ignoring the file's allow rules until you trust the workspace, then appends the next approved command, token included, to the same tracked file.
-
Claude CodeClaude Code Guards Your Email. Base64 Walks Right Past.
Claude Code 2.1.317 (npm 2026-11-02 23:57 UTC) adds a check that asks before a web or shell tool call sends the signed-in account's email address to the network. Hands-on: the check is a built-in plugin, cc-plugin-privacy (cc-plugin-privacy@builtin, absent from the 2.1.316 binary, not shown by claude plugin list, shown by claude plugin details), registered on tool.check for WebBrowser, WebFetch, WebSearch, Bash, Monitor, PowerShell and Tmux; it JSON-serialises the tool input, lowercases it, appends a once percent-decoded copy, looks for the session.identity() email, blanks it, and for the shell tools asks only if the rest matches /\b(curl|wget|https?|httpie|xh|nc|ncat|socat|telnet|ssh|scp|sftp|rsync|ftp|lftp|rclone|iwr|irm|invoke-webrequest|invoke-restmethod)\b/; it runs after the normal permission decision and turns an allow into an ask. Twenty headless Haiku 5.5 runs ($0.12) against a 127.0.0.1 capture server: a literal, upper-cased or %40-encoded address next to curl, a python3 urllib call with an http URL, a git push with the address in the URL and a WebFetch were all asked (denied headless); a different address, CLAUDE_CODE_USER_EMAIL, echo, git log --author and the Write tool passed; $(cat email.txt), base64, %2540 and a raw Python socket passed and the server received the address; enabledPlugins false via --settings switched it off, the same key in an untrusted repo's .claude/settings.json did not. The same build adds an unlisted sentence to the userEmail system prompt about sites that ask for a contact email in the User-Agent. Feature flag tengu_wise_newt defaults on; API-key sessions have no identity email so the check never fires (from the code, not run).
-
Claude CodeClaude Code's New Write Block Misses a printf Redirect
Claude Code 2.1.314 (30 Oct 2026) adds permissions.blockWritesOutsideWorkingDirectories. In 24 headless runs the Write and Edit tools refused every path outside the project, including through a symlink, in /tmp, and with Write(*) and Edit(*) allow rules that let the same write through when the setting was off. A printf redirect in Bash to the same folder went through, because the shell redirect check consults Edit rules and working directories, not this block. Side effects: settings.json in any .claude folder becomes a hard refusal, EnterWorktree and ExitWorktree disappear from the tool list, repository-supplied additionalDirectories don't count, 2.1.312 ignores the key silently. Auto-memory and the session's plan file still save. The settings reference has no entry yet.