Just encountered this: Claude Code DOES read all your secret, *.env, etc files by default, even if it's in  the .gitignore

You can add deny read rules (~/.claude/settings.json):

  "permissions": {
    "deny": [
      "Read(**/*.env*)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/secrets/**)",
      "Read(**/credentials/**)",
      "Read(**/.aws/**)",
      "Read(**/.ssh/**)",
      "Read(**/docker-compose*.yml)",
      "Read(**/config/database.yml)"
    ]
  }

• building @bankr
• founder @payflow 
• made in /crimea 🇺🇦

Gemini on the other hand keeps removing anything sensitive and asking me to fill in them myself (annoying af)

Normie truned into a degen growing into a builder in Farcaster | I'm mostly JK | Host /venting | mod /impact

yah, gemini is the worse for me, didn't find it reliable