Read deny permissions in settings.json not enforced for .env files

[RyanL2]

Bug Description

The read.deny permission rules in ~/.claude/settings.json are not being enforced. Claude Code can read files that match deny patterns, bypassing the configured restrictions.

Steps to Reproduce

1. Configure ~/.claude/settings.json with read deny rules:

{
  "permissions": {
    "read": {
      "deny": [
        "**/.env*",
        "**/*.pem",
        "**/*.key",
        "**/secrets/**",
        "**/credentials/**",
        "**/.aws/**",
        "**/.ssh/**"
      ]
    }
  }
}

2. Ask Claude Code to read the .env.local file in a project
3. Claude Code successfully reads and displays the file contents, including secrets and API keys

Expected Behavior

The Read tool call should be blocked by the deny rule **/.env*, and Claude Code should not be able to access the file contents.

Actual Behavior

The Read tool call succeeds despite matching the deny pattern. The full contents of .env.local (including API keys, secrets, and credentials) are read and displayed.

Impact

This is a security issue. Users who configure deny rules to protect sensitive files (.env, .pem, .key, credentials, etc.) have a false sense of security — the restrictions are not actually enforced. Sensitive secrets can be leaked into conversation context.

Environment

• Platform: macOS (Darwin 23.6.0)
• Claude Code model: claude-opus-4-6
• Settings location: ~/.claude/settings.json

[github-actions]

Found 3 possible duplicate issues:

1. Critical Security Bug: deny permissions in settings.json are not enforced** #6699
2. Permission Deny Configuration Not Enforced for Read/Write Tools #6631
3. Claude Code ignores deny rules in .claude/settings.local.json - security vulnerability #8961

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #6699.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code