Just encountered this: Claude Code DOES read all your secret, *.env, etc files by default, even if it's in  the .gitignore

You can add deny read rules (~/.claude/settings.json):

  "permissions": {
    "deny": [
      "Read(**/*.env*)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/secrets/**)",
      "Read(**/credentials/**)",
      "Read(**/.aws/**)",
      "Read(**/.ssh/**)",
      "Read(**/docker-compose*.yml)",
      "Read(**/config/database.yml)"
    ]
  }

• building @bankr
• founder @payflow 
• made in /crimea 🇺🇦

Crazy it asks for cat commands but doesn’t does it by default

Amusement, wonder, and uncertainty. Community funded aka revenue positive ✴︎ libred.org

i don't know, it might have asked for reading other files before - non secret, and ended up taking this rule too literal