%PDF-1.4 %âãÏÓ 1 0 obj << /Type /Catalog /Pages 2 0 R >> endobj 2 0 obj << /Type /Pages /Count 4 /Kids [5 0 R 7 0 R 9 0 R 11 0 R] >> endobj 3 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica >> endobj 4 0 obj << /Type /Font /Subtype /Type1 /BaseFont /Helvetica-Bold >> endobj 5 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595.28 841.89] /Resources << /Font << /F1 3 0 R /F2 4 0 R >> >> /Contents 6 0 R >> endobj 6 0 obj << /Length 5271 >> stream BT /F2 22 Tf 0.06 0.08 0.12 rg 1 0 0 1 46 789.89 Tm (Can Claude Code Still Read Your .env File After You) Tj ET BT /F2 22 Tf 0.06 0.08 0.12 rg 1 0 0 1 46 762.89 Tm (Block It? \(And How to Actually Stop It\)) Tj ET BT /F2 11 Tf 0.72 0.14 0.18 rg 1 0 0 1 46 725.89 Tm (TechRounder PDF Edition) Tj ET BT /F1 9.5 Tf 0.36 0.39 0.46 rg 1 0 0 1 46 709.89 Tm (Live article: https://www.techrounder.com/ai/can-claude-code-still-read-your-env-file-after-you-block-it/) Tj ET q 0.82 0.85 0.9 RG 1 w 46 691.39 m 549.28 691.39 l S Q BT /F1 10 Tf 0.24 0.27 0.32 rg 1 0 0 1 46 679.39 Tm (By Vipin PG | Published July 31, 2026 | Updated July 31, 2026 | Format: Analysis | 6 min read) Tj ET BT /F2 13 Tf 0.72 0.14 0.18 rg 1 0 0 1 46 656.39 Tm (In brief) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 636.39 Tm (Yes, in a specific and easy-to-miss way. A Read deny rule for .env in Claude Code's settings blocks) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 621.39 Tm (Claude's own file-reading tools and a handful of Bash commands it recognizes as reading files, like) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 606.39 Tm (cat or sed. It does not stop Claude from running a short script in Python, Node, or almost any language) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 591.39 Tm (that opens the file itself and prints what's inside, because Claude Code isn't inspecting what that script) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 576.39 Tm (does internally. Anthropic's own documentation confirms this gap directly. The only real fix is turning) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 561.39 Tm (on Claude Code's built-in sandbox, which enforces file access at the operating system level instead of) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 546.39 Tm (relying on Claude Code recognizing the command. Even then, you have to explicitly list .env and your) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 531.39 Tm (credentials folders as protected, because the sandbox's default read policy is surprisingly) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 516.39 Tm (permissive.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 491.39 Tm (If you've set up Claude Code to work in a project folder, there's a good chance you've added a line) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 476.39 Tm (like this to your settings, thinking it closes the door on your secrets:) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 452.39 Tm ({) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 435.515 Tm ("permissions": {) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 418.64 Tm ("deny": ["Read\(./.env\)"]) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 401.765 Tm (}) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 384.89 Tm (}) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 366.39 Tm (It feels airtight. Claude asks permission before it reads or edits anything, you've explicitly denied the) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 351.39 Tm (one file that matters most, and the settings file even lives in your git repo so the whole team benefits) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 336.39 Tm (from it. Job done.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 314.39 Tm (Except it isn't quite done. That rule works exactly as advertised for the situations most people picture) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 299.39 Tm (- Claude trying to open `.env` directly, or running `cat .env` in the terminal. But there's a gap in what) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 284.39 Tm (it actually covers, and understanding that gap matters a lot more once Claude is running with broader) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 269.39 Tm (permissions, like accept-edits mode or auto mode, on a machine that also holds your real credentials.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 241.39 Tm (What a "Read" deny rule actually blocks) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 217.39 Tm (Claude Code's permission system works in layers. Read-only actions like file reads normally don't) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 202.39 Tm (need your approval at all, Bash commands usually do, and file edits need approval until the session) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 187.39 Tm (ends. When you add a deny rule, it's checked before anything else: deny rules are evaluated first, then) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 172.39 Tm (ask rules, then allow rules, and the first match wins.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 150.39 Tm (A rule like `Read\(./.env\)` covers two things:) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 128.39 Tm (- Claude's own built-in tools - the Read tool, the Edit tool, Grep, and Glob) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 111.59 Tm (- A specific list of Bash commands Claude Code already knows are for reading files, such as `cat` ,) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 97.79 Tm (`head` , `tail` , and `sed`) Tj ET q 0.86 0.88 0.92 RG 1 w 46 42 m 549.28 42 l S Q BT /F1 8.4 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 30 Tm (TechRounder | Page 1 of 4) Tj ET BT /F1 7.2 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 19 Tm (https://www.techrounder.com/pdf/blog/can-claude-code-still-read-your-env-file-after-you-block-it.pdf) Tj ET endstream endobj 7 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595.28 841.89] /Resources << /Font << /F1 3 0 R /F2 4 0 R >> >> /Contents 8 0 R >> endobj 8 0 obj << /Length 5876 >> stream BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 789.89 Tm (This is genuinely useful. It stops the everyday case: Claude deciding on its own to peek at a config file,) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 774.89 Tm (or running an obvious command to print it. For most day-to-day work, this is exactly the protection) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 759.89 Tm (people expect.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 731.89 Tm (Where the gap actually is) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 707.89 Tm (The problem is what falls outside that list. Claude Code's permission check works by recognizing the) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 692.89 Tm (shape of a file-reading action - a specific tool call, or a specific command it already knows reads) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 677.89 Tm (files. It doesn't trace through what an arbitrary program does once it starts running.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 655.89 Tm (So if Claude writes a two-line Python script that opens `.env` using its own file-handling code and) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 640.89 Tm (prints the contents, then runs that script with `python script.py`, nothing about that looks like a file read) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 625.89 Tm (to Claude Code. From its point of view, it's just executing a Bash command - the same category as) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 610.89 Tm (running a test suite or a build script. The deny rule never gets a chance to fire, because the actual file) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 595.89 Tm (access is happening inside a process Claude Code isn't looking inside of.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 573.89 Tm (This isn't a bug and it isn't something Anthropic is hiding. Their documentation states this limitation) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 558.89 Tm (plainly: permission rules on Read and Edit apply to Claude's built-in tools and to the Bash commands) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 543.89 Tm (Claude Code recognizes, and they explicitly do not extend to a Python or Node script that reads files on) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 528.89 Tm (its own. If you want something that blocks every process regardless of how it reads a file, the) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 513.89 Tm (documentation points to one specific feature: the sandbox.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 485.89 Tm (Why Claude Code is built this way) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 461.89 Tm (Permission rules and sandboxing are two different layers doing two different jobs, and Anthropic) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 446.89 Tm (treats them that way on purpose. Permission rules are a fast, low-friction way to control which tool) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 431.89 Tm (calls Claude is allowed to make - they're enforced by Claude Code itself, not by the model, which is) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 416.89 Tm (why prompt instructions can't override them. But they were never meant to be a hard security) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 401.89 Tm (boundary against arbitrary code execution. That's what the sandbox is for.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 379.89 Tm (Sandboxing gives Claude Code actual operating-system-level enforcement: Seatbelt on macOS, and) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 364.89 Tm (bubblewrap on Linux and WSL2 \(native Windows isn't supported - you'd need to run inside WSL2\).) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 349.89 Tm (Once it's on, restrictions apply to every Bash command and everything that command spawns,) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 334.89 Tm (including that Python script that would have slipped past a simple deny rule. This is the layer that) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 319.89 Tm (actually closes the gap described above.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 291.89 Tm (The catch: sandboxing doesn't lock down reads by default) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 267.89 Tm (Here's the part that surprises most people who turn sandboxing on expecting it to solve the problem) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 252.89 Tm (completely: by default, the sandbox's read policy is wide open. It restricts writes tightly - sandboxed) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 237.89 Tm (commands can only write inside your working directory and a temp folder unless you say otherwise -) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 222.89 Tm (but for reads, the default is access to almost the entire computer, except a small set of blocked) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 207.89 Tm (locations.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 185.89 Tm (That default is permissive enough that it still allows reading files like `~/.aws/credentials` and) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 170.89 Tm (`~/.ssh/` unless you explicitly tell it not to. In other words: turning sandboxing on, by itself, does not) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 155.89 Tm (automatically protect your `.env` file or your cloud credentials from that same subprocess trick. You) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 140.89 Tm (still have to name the paths you want protected.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 112.89 Tm (A configuration that actually closes the loop) Tj ET q 0.86 0.88 0.92 RG 1 w 46 42 m 549.28 42 l S Q BT /F1 8.4 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 30 Tm (TechRounder | Page 2 of 4) Tj ET BT /F1 7.2 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 19 Tm (https://www.techrounder.com/pdf/blog/can-claude-code-still-read-your-env-file-after-you-block-it.pdf) Tj ET endstream endobj 9 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595.28 841.89] /Resources << /Font << /F1 3 0 R /F2 4 0 R >> >> /Contents 10 0 R >> endobj 10 0 obj << /Length 5020 >> stream BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 789.89 Tm (Putting this together, a setup that meaningfully protects sensitive files needs three pieces working) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 774.89 Tm (together: your existing permission deny rules \(for the everyday case\), the sandbox turned on \(for) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 759.89 Tm (OS-level enforcement\), and explicit read protection inside the sandbox itself \(because the sandbox's) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 744.89 Tm (defaults won't do this for you\).) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 720.89 Tm ({) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 704.015 Tm ("permissions": {) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 687.14 Tm ("deny": [) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 670.265 Tm ("Read\(./.env\)",) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 653.39 Tm ("Read\(./.env.*\)",) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 636.515 Tm ("Read\(./secrets/**\)") Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 619.64 Tm (]) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 602.765 Tm (},) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 585.89 Tm ("sandbox": {) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 569.015 Tm ("enabled": true,) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 552.14 Tm ("allowUnsandboxedCommands": false,) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 535.265 Tm ("filesystem": {) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 518.39 Tm ("denyRead": ["~/.ssh", "~/.aws"]) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 501.515 Tm (},) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 484.64 Tm ("credentials": {) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 467.765 Tm ("files": [) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 450.89 Tm ({ "path": "./.env", "mode": "deny" },) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 434.015 Tm ({ "path": "~/.aws/credentials", "mode": "deny" },) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 417.14 Tm ({ "path": "~/.ssh", "mode": "deny" }) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 400.265 Tm (]) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 383.39 Tm (}) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 366.515 Tm (}) Tj ET BT /F1 9.5 Tf 0.18 0.2 0.24 rg 1 0 0 1 54 349.64 Tm (}) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 331.14 Tm (Two settings above are doing quiet but important work:) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 309.14 Tm (- `allowUnsandboxedCommands: false` - Without this, Claude Code includes a built-in fallback: if a) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 295.34 Tm (command fails because the sandbox is blocking it, Claude Code may simply retry that command outside the) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 281.54 Tm (sandbox instead. That's a sensible default for usability, but it also means a command that's failing) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 267.74 Tm (specifically because it's trying to touch something protected could quietly get a second attempt with no) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 253.94 Tm (sandbox at all. Setting this to `false` removes that fallback, so a blocked command stays blocked.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 237.14 Tm (- Listing paths under both `denyRead` and `credentials.files` - This is deliberate belt-and-suspenders. The) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 223.34 Tm (dedicated credentials block exists specifically so credential protection doesn't get lost or overridden in a) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 209.54 Tm (larger settings file, while `denyRead` catches anything else you want off-limits.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 192.74 Tm (If some of your tools genuinely need a credential to function - for example, a script that has to) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 177.74 Tm (authenticate with an API - there's also a masking option in Claude Code's sandbox settings that) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 162.74 Tm (substitutes a placeholder value for sandboxed commands and only swaps in the real credential when a) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 147.74 Tm (request actually reaches an approved destination. It's a more advanced setup, but worth knowing it) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 132.74 Tm (exists if "deny everything" breaks something you actually need working.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 104.74 Tm (What this still doesn't cover) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 80.74 Tm (Even with all of the above in place, it's worth being honest about the edges:) Tj ET q 0.86 0.88 0.92 RG 1 w 46 42 m 549.28 42 l S Q BT /F1 8.4 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 30 Tm (TechRounder | Page 3 of 4) Tj ET BT /F1 7.2 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 19 Tm (https://www.techrounder.com/pdf/blog/can-claude-code-still-read-your-env-file-after-you-block-it.pdf) Tj ET endstream endobj 11 0 obj << /Type /Page /Parent 2 0 R /MediaBox [0 0 595.28 841.89] /Resources << /Font << /F1 3 0 R /F2 4 0 R >> >> /Contents 12 0 R >> endobj 12 0 obj << /Length 4030 >> stream BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 789.89 Tm (- The sandbox only wraps Bash commands and what they spawn. Claude's built-in Read, Edit, and Write) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 776.09 Tm (tools never run inside the sandbox at all - they rely on the permission rules covered earlier, which is) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 762.29 Tm (exactly why both layers matter together.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 745.49 Tm (- Native Windows isn't supported. If you're on Windows, you need WSL2 for any of this to apply.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 728.69 Tm (- The sandbox's network filtering checks the domain a request is going to, but by default it doesn't inspect) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 714.89 Tm (the actual encrypted traffic. Allowing a broad domain still means trusting that domain's infrastructure isn't) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 701.09 Tm (misused to move data somewhere you didn't intend.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 684.29 Tm (- This is specific to Claude Code. If you're also using Claude through MCP connectors, computer use, or) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 670.49 Tm (other integrations, those have their own separate access boundaries and aren't covered by the sandbox) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 656.69 Tm (settings above.) Tj ET BT /F2 15 Tf 0.08 0.1 0.14 rg 1 0 0 1 46 633.89 Tm (The practical takeaway) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 609.89 Tm (None of this means permission deny rules are pointless - they're still the right first step and they stop) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 594.89 Tm (the most common accidental exposure. But they're a set of guardrails around Claude's own) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 579.89 Tm (recognized actions, not a wall around your filesystem. If Claude has been given the ability to run) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 564.89 Tm (arbitrary shell commands in a project that also has real credentials nearby - which describes most) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 549.89 Tm (homelab and self-hosted setups - the deny rule alone is doing less than it looks like it's doing.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 527.89 Tm (The short version to actually act on:) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 505.89 Tm (1. Keep your existing `Read` / `Edit` deny rules. They're still useful.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 489.09 Tm (2. Don't treat them as a security boundary on their own - treat them as a courtesy check.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 472.29 Tm (3. Turn on Claude Code's sandbox for any project where Claude can run commands and edit files freely,) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 458.49 Tm (especially in accept-edits, auto, or bypass-permissions modes.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 441.69 Tm (4. Explicitly deny your sensitive paths inside the sandbox settings. Don't assume the defaults protect them.) Tj ET BT /F1 10.5 Tf 0.2 0.23 0.28 rg 1 0 0 1 46 424.89 Tm (5. Turn off the unsandboxed-retry fallback if you want the protection to actually hold under pressure.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 408.09 Tm (Claude Code is being trusted with more autonomy every month - that's the whole appeal of it.) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 393.09 Tm (Understanding exactly where its guardrails stop, and where the operating system has to take over, is) Tj ET BT /F1 11 Tf 0.14 0.16 0.2 rg 1 0 0 1 46 378.09 Tm (what keeps that autonomy from quietly becoming a liability.) Tj ET q 0.86 0.88 0.92 RG 1 w 46 42 m 549.28 42 l S Q BT /F1 8.4 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 30 Tm (TechRounder | Page 4 of 4) Tj ET BT /F1 7.2 Tf 0.42 0.45 0.5 rg 1 0 0 1 46 19 Tm (https://www.techrounder.com/pdf/blog/can-claude-code-still-read-your-env-file-after-you-block-it.pdf) Tj ET endstream endobj xref 0 13 0000000000 65535 f 0000000015 00000 n 0000000064 00000 n 0000000140 00000 n 0000000210 00000 n 0000000285 00000 n 0000000427 00000 n 0000005749 00000 n 0000005891 00000 n 0000011818 00000 n 0000011961 00000 n 0000017033 00000 n 0000017177 00000 n trailer << /Size 13 /Root 1 0 R >> startxref 21259 %%EOF