chore: claude code permissions should not be checked in

[ActuallyTrent]

The permissions file allows all bash commands (Bash(*)), but even if it didn't it still allows many dangerous commands (Bash(rm:*), Bash(node:*)).

While I don't think this in and of itself is really all that exploitable, I do think it increases the exposure risk of community members.

People who want to contribute to the repository may become at risk to something like a compromised MCP server or a model going a bit wild, even if they would normally manually approve commands.

My personal take is that a public repository should not prescribe permissions for something as powerful as Claude Code.

Anthropic's documentation suggest adding .claude/settings.local.json to the .gitignore, as well.

---

Important

Remove all allowed Bash commands from .claude/settings.local.json to reduce exposure risk.

• Permissions:
  • Remove all allowed Bash commands from permissions in .claude/settings.local.json, leaving allow list empty.
  • No changes to deny list.

^{This description was created by for e6cc466. You can customize this summary. It will automatically update as commits are pushed.}

[vercel]

@ActuallyTrent is attempting to deploy a commit to the Boundary Team on Vercel.

A member of the Team first needs to authorize it.

[ellipsis-dev]

Important

Looks good to me! 👍

Reviewed everything up to e6cc466 in 41 seconds. Click for details.

• Reviewed 57 lines of code in 1 files
• Skipped 0 files when reviewing.
• Skipped posting 2 draft comments. View those below.
• Modify your settings and rules to customize what types of comments Ellipsis leaves. And don't forget to react with 👍 or 👎 to teach Ellipsis.

1. .claude/settings.local.json:4

• Draft comment:
  Empty 'allow' array: Ensure that disabling all commands is intentional and won’t break expected behavior. Consider adding an inline comment explaining the rationale.
• Reason this comment was not posted:
  Comment did not seem useful. Confidence is useful = 50% <= threshold 50% The comment is asking the author to ensure that disabling all commands is intentional, which is not allowed. However, it also suggests adding an inline comment explaining the rationale, which is a specific suggestion to improve code clarity. The first part of the comment is not allowed, but the second part is useful.

2. .claude/settings.local.json:7

• Draft comment:
  Missing trailing newline at end of file. Please add one to follow best practices.
• Reason this comment was not posted:
  Confidence changes required: 33% <= threshold 50% None

Workflow ID: wflow_UnRMeIxDqGv9KJwY

^{You can customize by changing your verbosity settings, reacting with 👍 or 👎, replying to comments, or adding code review rules.}

[sxlijin]

Thanks for this! We've definitely been a little aggressive with our own Claude Code adoption and I totally hear you on the security risks here. Sorry this lounged for so long, but I'll merge this now :)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!