article
Stop Claude Code Reading Your .env: deny vs hook vs sandbox
To keep Claude Code out of your .env, permissions.deny (Read(./.env)) stops the honest mistakes — the Read tool and a literal cat .env — but it is a string match, so node -e readFileSync('.env') or a filename assembled from fragments reads right through. A PreToolUse hook catches the script but still falls to the assembled name. Only the sandbox (sandbox.enabled with sandbox.filesystem.denyRead, Claude Code v2.1.187+) blocks every bypass at the OS level with EPERM. Ranking: sandbox > hook > deny. deny is a mistake-guard, not a security boundary.