Lock Claude Code out of your .env

01Start it in your project folder

Claude Code works from the folder you start it in. Start it in your project, not your home folder, so your other projects and dotfiles aren't in reach to begin with.

cd ~/code/my-app
claude

You should see your project's path in the Claude Code header.

02Add deny rules to settings.json

Create .claude/settings.json in the project (or add to it) and deny reads of your env files and key folders ^[1]. Deny rules are checked before allow rules, and an allow rule can't make an exception to a deny rule. The file is strict JSON: no comments and no trailing commas ^[3].

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)"
    ]
  }
}

Commit this file so everyone on the project gets the same rules. Deny rules apply right away, even before someone trusts the folder ^[3].

In my test, the Read tool was refused. You should see Claude Code report that reading .env is denied by your settings.

03Turn on the sandbox

Read deny rules cover Claude's own file tools and the shell commands Claude Code recognizes, such as cat, head and tail. They don't cover a script that opens the file itself ^[1]. In my test, a short Python script still printed the fake keys past the deny rule.

The sandbox fixes that at the operating system level ^[2]. Add it to the same file:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "denyRead": ["./.env", "~/.ssh", "~/.aws"]
    }
  }
}

Or type /sandbox inside Claude Code to turn it on interactively. The sandbox works on macOS, Linux and WSL2. On Linux and WSL2 it needs two packages first ^[2]:

sudo apt-get install bubblewrap socat

Warning: if the sandbox can't start, Claude Code runs commands without it unless you also set "failIfUnavailable": true inside "sandbox" ^[2].

With the sandbox on, the same Python script got Permission denied in my test.

04Check that it worked

Put a fake key in .env, then ask Claude Code to read it, both directly and through a script.

echo "API_KEY=fake-123" > .env
claude

Read .env and tell me what API_KEY is.
Run: python3 -c "print(open('.env').read())"

You should see the first request refused by your deny rule and the second fail with Permission denied. Type /permissions to see every rule that's active.

05Rotate any key it already saw

If Claude Code read a real .env before you did this, treat those keys as exposed. Create new keys in each provider's dashboard, put them in .env, and revoke the old ones. The rules above stop the next read; they can't undo an earlier one.

Your .env, ~/.ssh and ~/.aws are now off limits to Claude Code's tools and to anything it runs in the sandbox.