A safe Claude Code settings.json template (copy and paste)
Allow the specific commands your project runs (tests, lint, build), put risky but sometimes needed commands in ask, and deny secrets, the .claude directory and destructive commands. Avoid wildcard interpreter rules like Bash(python3 *), which allow any code.
Stats from the 2026-10-20 snapshot of public GitHub configs (methodology). Behavior checked against the official docs linked below.
Template
{
"permissions": {
"allow": [
"Bash(npm run test *)",
"Bash(npm run lint)",
"Bash(npm run build)",
"Bash(git status)",
"Bash(git diff *)"
],
"ask": [
"Bash(git commit *)",
"Bash(npm install *)",
"WebFetch"
],
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Read(./secrets/**)",
"Edit(./.claude/**)",
"Write(./.claude/**)",
"Bash(git push *)",
"Bash(rm -rf *)",
"Bash(curl *)",
"Bash(wget *)"
]
}
}Why each list looks like this
allow is for commands you'd approve every time anyway. ask is for things you want to see before they run. deny always wins, in every permission mode, so it's where secrets and irreversible commands go. Change the npm commands to whatever your project uses.
Common mistakes in public configs
Of 4,831 unique public configs with permissions: 24% allow a wildcard interpreter (python, node, npx and similar), 12.5% allow curl or wget to any URL, 6.7% allow rm with a wildcard, and 1% turn on bypass mode in the file.
Check your own file
Paste it into the grader on this site. It runs in your browser and the config isn't uploaded.
FAQ
Is settings.json or settings.local.json better?
settings.json is shared and committed; settings.local.json is personal and usually gitignored. Put team rules in settings.json.
Can I use this template with bypassPermissions?
Deny rules still apply in bypassPermissions mode, but allow and ask stop mattering. Keep bypass for disposable containers.