Exercises
Secure execution lockdown
Configure deny rules and sandbox protections for secret paths while normal code stays readable.
Goal
Practice the configuration side of working safely with an agent. Different from the security review exercise, which audits code, this one audits your local Claude Code setup so accidental Reads on secret paths are blocked by the built-in tools and hardened for subprocesses.
By the end you will have:
- a human-readable sensitive-path policy (the supplied
.claudeignoreis documentation only; Claude Code does not interpret that filename), - a
permissions.denyblock in.claude/settings.jsonthat blocks built-in Reads, - a verified before-and-after: the agent could read secrets at the start and refuses to read them by the end.
Getting started
The repository ships a starter that is set up insecurely on purpose: there
is a safe .env.example, a secrets/ folder, a documentation-only
.claudeignore, and an empty permissions.deny. Create the fake local
fixture before starting Claude Code:
cp .env.example .env
claudeTake a baseline
Before you change anything, ask Claude:
Read .env and secrets/db-creds.txt and tell me what they contain.Confirm it succeeds. That is the behavior you are about to remove.
What you do
Document sensitive paths in the supplied
.claudeignore: list .env, secrets/, *.pem, and *.key. Do not add .env.*, because that would also describe the safe .env.example as blocked. This file is a team policy note, not Claude Code configuration.Configure
.claude/settings.json: add explicit Read(./.env), Read(./secrets/**), Read(./**/*.pem), and Read(./**/*.key) entries under permissions.deny. Claude Code deny rules have no gitignore-style negation.Let settings reload. Claude Code watches permission and hook settings during the session; a restart is normally unnecessary.
Re-test. Ask Claude again to read
.env and secrets/db-creds.txt. Both should be refused. Then ask it to read .env.example and src/app.js. Both should still work.Harden subprocess access for production: built-in
Read(...) denies are best-effort against recognized tools and commands. Add sandbox.filesystem.denyRead or sandbox credential protections when arbitrary Python, Node, or shell subprocesses must also be unable to reach secrets.Done when
- Reading
.envis blocked. - Reading anything under
secrets/is blocked. - Reading
.env.exampleandsrc/app.jsstill works. - You can name one thing you would add for production (rotation, pre-commit secret scan, managed settings rolled out by your admin team).