The One Settings Line That Stops Claude Reading Your Passwords File
By default Claude can open any file in your project without asking, your .env file of secret keys included. One deny rule in your settings file seals it, and Claude keeps working the same
Claude Code asks before it edits files or runs most commands, but reading a file inside your project needs no approval. That includes your .env file, where your API keys and passwords usually live.
If Claude opens it while it hunts a bug, every key in it lands in the conversation. One deny rule stops that, and nothing else about how you work changes.
What changes with the rule
| No rule (default) | With the deny rule | |
|---|---|---|
| Claude can read .env | Yes, without asking | No, the read is blocked |
| cat .env / head .env in Claude's shell | Asks or runs | Blocked |
| Claude can edit or overwrite .env | Asks first | Blocked |
| Your normal coding | Same | Same |
Free, for your email
Get the full setup steps + the copy-paste setup prompt
The rest of this guide (3 more sections, 2 copy-paste prompts) opens right here. The setup prompt, one paste into Claude that sets it all up, comes by email only. Use your real address.
50,000+ follow where these guides come from. No spam, unsubscribe in one click.