Claude Code's deny rules don't stop grep

A developer blogged about a routine session in which Claude Code ran grep against a secrets file and read the contents, even though .claude/settings.local.json had permissions.deny rules covering it. The reason: deny rules fire on the Read tool, and shell commands go through a separate Bash tool entirely.

Writing deny rules for Bash doesn't close the hole either. You'd have to enumerate every possible way to read a file, from sed to xxd to strings. The Bash sandbox in Anthropic's docs does help: you declare which files and network domains commands can touch, and the operating system enforces that boundary for each command and its child processes.

The author calls the sandbox a half measure and argues against keeping secrets in the repository as plaintext at all, even behind .gitignore. He moved his own into a secrets store.