Claude Code settings files: what 12,796 public repositories allow
Claude Code reads a .claude/settings.json file from every repository it works in. We read 12,796 of the public ones on GitHub and counted what they allow, deny and switch on.
Research, Claude Code settings
- Files read
- 12,796 public repositories
- No deny rule
- 81% of files
- Allow every Bash
- 2.7% of files
- Bypass setting
- 1.9% of files
- Collected
- 19 October 2026
The short answer
We read 12,796 public .claude/settings.json files on GitHub on 19 October 2026, sampled across every file size and weighted to match. About 81% define no deny rule, 2.7% allow every Bash command and 1.9% carry a bypass setting. GitHub also lists 3,928 files named .claudeignore, which Claude Code's documentation says have no effect.
Six findings
Each figure is the share of all public settings files that set the thing named. The sample is weighted by file size so that it speaks for the whole population, and every figure in the tables below is within 0.8 percentage points of the true share ninety-five times in a hundred. That range covers sampling error only. The method section says what else could be off.
Most files set no deny rule. 81% of the files define no deny rule, and only 19% define one.
Bash is allowed by pattern. 42% allow Bash with a wildcard such as Bash(git *), and 2.7% allow every Bash command.
Few deny the common secrets. 8.0% deny reading a .env file, and 9.1% deny a path that holds secrets, keys or credentials.
Half the files set hooks. 52% set hooks, and 27% set a PreToolUse hook, the event that can inspect a command before it runs.
Bypass lines are rare and ignored. 1.9% carry a dangerously-skip or bypass setting. Claude Code ignores bypassPermissions in project files.
One file Claude Code does not read. GitHub lists 3,928 files named .claudeignore. The permissions page says that file has no effect.
Most files set no deny rule
57% of the files carry a permissions block at all. 50% list at least one allow rule and 19% list at least one deny rule. 35% allow something and deny nothing. The files that do set deny rules set a median of 6 of them.
Order matters here. Claude Code's permissions page says rules are evaluated "deny, then ask, then allow", and the first match decides. A deny at any settings level beats an allow at any other, so a deny rule is the line that holds against a broad allow rule written somewhere else.
| Setting | Share of files | Files in sample |
|---|---|---|
| Has a permissions block | 57% | 7,292 of 12,796 |
| Has an allow rule | 50% | 6,395 of 12,796 |
| Has a deny rule | 19% | 2,537 of 12,796 |
| Has an ask rule | 4.9% | 648 of 12,796 |
| Allows something and denies nothing | 35% | 4,473 of 12,796 |
Bash is the tool teams allow
46% of the files allow at least one Bash rule, more than any other tool. 42% use a wildcard pattern such as Bash(git *), which allows a whole family of commands. 2.7% go further and allow every Bash command with a bare Bash or Bash(*) rule. A file in that last group with no deny rule lets the model run any shell command without asking. 1.8% of all files are in that position.
| Tool | Share of files | Files in sample |
|---|---|---|
Bash | 46% | 5,861 of 12,796 |
Read | 12% | 1,577 of 12,796 |
WebFetch | 11% | 1,450 of 12,796 |
mcp__* | 9.6% | 1,247 of 12,796 |
Edit | 8.5% | 1,114 of 12,796 |
WebSearch | 7.4% | 964 of 12,796 |
Write | 7.1% | 928 of 12,796 |
Grep | 4.7% | 614 of 12,796 |
The commands people allow are the ones a coding session needs: git, ls and gh. 6.6% of the files also allow an rm, sudo, curl or wget rule, and 5.9% allow Write or Edit with no path limit.
| Command | Share of files | Files in sample |
|---|---|---|
git | 25% | 3,291 of 12,796 |
ls | 13% | 1,689 of 12,796 |
gh | 12% | 1,624 of 12,796 |
grep | 11% | 1,389 of 12,796 |
npm | 10% | 1,313 of 12,796 |
find | 9.7% | 1,269 of 12,796 |
cat | 8.7% | 1,137 of 12,796 |
npx | 8.3% | 1,092 of 12,796 |
wc | 6.6% | 871 of 12,796 |
mkdir | 6.7% | 865 of 12,796 |
What the deny rules protect
Across all files, 8.0% deny reading a .env file and 9.1% deny reading or writing a path that holds secrets, keys or credentials. 7.8% deny rm and 7.4% deny git push. The rule Claude Code's own documentation uses as its example, Read(./.env), is the one that protects the most common secret file, and most repositories do not carry it.
A deny rule has limits that the documentation spells out. Read and Edit deny rules cover Claude's file tools and the file commands Claude Code recognises in Bash, such as cat and sed. They do not cover a Python or Node script that opens files itself. A rule such as Bash(rm *) matches rm -rf build/ and misses /bin/rm and bash -c 'rm ...'. For a block that must hold against every process, the documentation points to the sandbox.
| Setting | Share of files | Files in sample |
|---|---|---|
| Denies Read on a .env file | 8.0% | 1,040 of 12,796 |
| Denies a secrets, key or credentials path | 9.1% | 1,174 of 12,796 |
| Denies an rm command | 7.8% | 1,016 of 12,796 |
| Denies git push | 7.4% | 963 of 12,796 |
| Rule | Share of files | Files in sample |
|---|---|---|
Bash(rm -rf *) | 4.0% | 519 of 12,796 |
Bash(git push --force *) | 3.1% | 406 of 12,796 |
Read(./.env) | 3.1% | 402 of 12,796 |
Bash(sudo *) | 2.8% | 367 of 12,796 |
Bash(git reset --hard *) | 2.5% | 332 of 12,796 |
Bash(git push -f *) | 2.4% | 318 of 12,796 |
Read(./.env.*) | 2.3% | 294 of 12,796 |
Read(.env) | 2.0% | 255 of 12,796 |
Bypass settings, and what Claude Code does with them
1.0% of the files set permissions.defaultMode to bypassPermissions, and 0.7% set skipDangerousModePermissionPrompt. Counting every form, including a --dangerously-skip-permissions flag inside a hook command, 1.9% carry a dangerously-skip or bypass setting.
The first of those no longer does what it says in a project file. Claude Code's settings page states that auto and bypassPermissions do not take effect from project or local settings, and that before v2.1.257 bypassPermissions took effect from any file. A bypass line in a project file today is a leftover from an older version or a note about how its author runs Claude Code. The reference lists skipDangerousModePermissionPrompt as a user, local or managed setting, which leaves project files out.
0.2% of the files set permissions.disableBypassPermissionsMode, the key that switches bypass mode off. The permissions page says it works from any settings file and is most useful in managed settings, where it cannot be overridden.
| Setting | Share of files | Files in sample |
|---|---|---|
| defaultMode is bypassPermissions | 1.0% | 128 of 12,796 |
| skipDangerousModePermissionPrompt is set | 0.7% | 91 of 12,796 |
| Any dangerously-skip or bypass setting | 1.9% | 252 of 12,796 |
| disableBypassPermissionsMode is set | 0.2% | 29 of 12,796 |
Hooks, env, model, sandbox and MCP approvals
Hooks are the most used feature outside permissions. 52% of the files set at least one, and 27% set a PreToolUse hook, the event that runs before a tool call and can inspect the full command. Fewer files set the rest: 8.8% define env variables, 2.6% pin a model, 1.6% carry a sandbox setting and 1.0% turn it on. 4.4% approve project MCP servers in the file.
| Event | Share of files | Files in sample |
|---|---|---|
PostToolUse | 27% | 3,531 of 12,796 |
PreToolUse | 27% | 3,439 of 12,796 |
SessionStart | 19% | 2,493 of 12,796 |
Stop | 14% | 1,866 of 12,796 |
UserPromptSubmit | 7.6% | 1,003 of 12,796 |
| Key | Share of files | Files in sample |
|---|---|---|
permissions | 57% | 7,292 of 12,796 |
hooks | 52% | 6,734 of 12,796 |
enabledPlugins | 18% | 2,297 of 12,796 |
env | 9.0% | 1,161 of 12,796 |
extraKnownMarketplaces | 6.3% | 802 of 12,796 |
attribution | 4.5% | 582 of 12,796 |
statusLine | 4.0% | 532 of 12,796 |
enableAllProjectMcpServers | 3.1% | 402 of 12,796 |
enabledMcpjsonServers | 3.0% | 378 of 12,796 |
model | 2.6% | 345 of 12,796 |
The file Claude Code does not read
1.5% of the repositories in the sample carry a .claudeignore file at the root. GitHub code search finds 3,928 files with that name across public repositories. Claude Code's permissions page says it plainly: "If your project has a .claudeignore file, it has no effect." The documented replacement is a Read deny rule such as Read(./.env).
Of the 191 sampled repositories that have a .claudeignore, 118 have no deny rule in their settings file. A .claudeignore is written to keep files away from the model, and in those repositories nothing in the settings file backs it up. The count is small, so treat it as a direction.
The short file that closes the common gaps
Save this as .claude/settings.json at the repository root. It denies the reads and the delete that appear in the documentation and shuts bypass mode off.
{
"permissions": {
"deny": ["Read(./.env)", "Read(./secrets/**)", "Bash(rm *)"],
"disableBypassPermissionsMode": "disable"
}
}
- Deny rules are checked first, so a broad allow rule in a user or project file cannot reopen these paths.
- The Read rules protect the files Claude reads through its own tools and through recognised commands such as cat. For a path that no process may touch, turn the sandbox on.
- The rm rule matches the plain command and misses a path-qualified one. Treat it as a guard against the common slip.
- The disable key works from this file, and a managed settings file can set it where developers cannot change it.
What a team can do with this
We run Digiton's sales and operations agents on the scheduler built into macOS, so what an agent may do unattended is a question we answer for our own work before we answer it for anyone else. Our production engineering, AI agent development and custom AI development work starts from the same question. For the policy side, read our Claude Code governance guide. For the wider picture of coding agents and access control, read the Claude Code, Cursor and Codex comparison, the agent governance guide and the agentjacking defense page.
- Open the settings file in each repository and look for a deny rule on .env.
- Look for a bypass line and for an allow rule that covers the whole shell.
- Add the short file above, then commit it so every teammate gets the same rules.
- Put the same rules in managed settings on the machines you control, where developers cannot change them.
How we sampled and what it cannot tell you
- We ran GitHub code search for
filename:settings.json extension:json path:/.claudeon 19 October 2026. For the whole size range it reported 72,832 files, and the 129 size bands we split that range into report 87,396 between them, so its counts are estimates. The search API returns at most 1,000 results for one query and allows 10 code searches a minute, which is why we split the range into bands of at most 1,000 files each. - The search's totals are estimates, so we checked them. 13 bands, paged to their end, returned between 86% and 152% of the total the search had reported for them. Scaling each band's weight by the ratio measured on its neighbours moves the headline shares by at most 1.3 percentage points. Multiplying every band's weight by a random factor in that range, 200 times over, moves them by 0.4 points or less in 95 draws out of 100 and by 0.8 at most.
- From each band we took two non-overlapping slices, results 1 to 50 and results 51 to 100. That gave 12,899 files. 66 sat at other paths and were set aside, 12,833 downloaded at the commit the search index saw, and 15 of those needed comments or trailing commas removed before they parsed.
- We dropped 36 files that are not JSON and 1 archived repository. 12,796 files remain. GitHub indexes a fork only in narrow cases, and the sample held none. Only the file at
.claude/settings.jsonin the repository root counts, so a monorepo adds one file. - Each file stands for the files in its size band divided by the number we sampled from that band. A band that holds many files counts for more, which corrects the fact that small files are far more common than large ones. The 95% range comes from the variance inside each band.
- The two slices were also analysed apart. On the 11 headline figures they differ by at most 1.3 percentage points, inside the 2 point limit we set before looking.
- Keeping only repositories with at least 10 stars (7,414 files), or only repositories pushed in the 90 days before collection (10,234 files), moves the headline shares by at most 1.5 points.
- Limits. GitHub indexes the default branch only. Inside a size band the search returns results by best match and not at random, so popular repositories could be over-represented, and the 95% range does not cover that. Settings in
settings.local.json, in user settings and in managed settings are invisible to a public search. A rule in a file records what its author wrote and not what Claude Code enforces, since a project's allow rules apply only after the workspace trust dialog is accepted. - The page and the downloads hold counts and no repository, owner or file name. The stored sample replaces repository names with hashes and blanks env values.
Download the data and the script
The table behind this page is aggregate.csv and the full output is results.json. The pipeline is six small Node files with no dependencies: collect.mjs, fetch.mjs, calibrate.mjs, aggregate.mjs, lib.mjs and stats.mjs. Run them with the GitHub CLI logged in.
node collect.mjs --out data/private/run-a --page 1
node collect.mjs --out data/private/run-b --page 2 --partition data/private/run-a/state.json
node fetch.mjs --runs data/private/run-a data/private/run-b
node calibrate.mjs --state data/private/run-a/state.json
node aggregate.mjs
The search index moves every day, so a new run draws different files and its shares will differ from these by sampling error. The page content is built from results.json, so no figure here was typed by hand.
Sources, checked 2026-10-19
8 sources
- Claude Code evaluates permission rules in the order deny, then ask, then allow, and the first match decides.Source: code.claude.com, checked 2026-10-19.
- Claude Code documents that a .claudeignore file has no effect and its entries belong in Read deny rules.Source: code.claude.com, checked 2026-10-19.
- Read and Edit deny rules cover built-in file tools and recognised file commands in Bash, and the sandbox is the documented way to block every process from a path.Source: code.claude.com, checked 2026-10-19.
- permissions.disableBypassPermissionsMode set to "disable" works from any settings file.Source: code.claude.com, checked 2026-10-19.
- permissions.defaultMode values auto and bypassPermissions do not take effect from project or local settings, and bypassPermissions did before v2.1.257.Source: code.claude.com, checked 2026-10-19.
- skipDangerousModePermissionPrompt is a user, local or managed setting.Source: code.claude.com, checked 2026-10-19.
- The GitHub search API returns up to 1,000 results per search and limits code search to 10 requests per minute.Source: docs.github.com, checked 2026-10-19.
- GitHub code search indexes the default branch only.Source: docs.github.com, checked 2026-10-19.
Digiton Dynamics OÜ is registered in Tallinn, Estonia, and delivers from Lisbon.
Frequently asked questions
Does a bypassPermissions line in .claude/settings.json turn off permission prompts?
In current versions it does nothing. Claude Code's settings page says bypassPermissions does not take effect from project or local settings, and that before v2.1.257 it took effect from any file. Set it in user settings or pass --permission-mode for one session.
Is a repository with no deny rule unsafe?
A missing deny rule means nothing in the file blocks a call. In default mode Claude Code still asks before it runs a Bash command that no allow rule covers, so the exposure depends on the allow rules and on how fast people approve prompts. The combination to look for is a broad allow rule with no deny rule, which 1.8% of the files have.
Does Claude Code read a .claudeignore file?
No. The permissions documentation says a .claudeignore file has no effect. Move its entries into Read deny rules such as Read(./.env) and Read(./secrets/**).
Where do the numbers come from?
From results.json, which the aggregate script writes from the sampled files. The page content is built from that file, so no figure was typed by hand. The script and the data are linked in the download section.
Can I see which repositories are in the sample?
No. The page and the downloads hold counts only, and the stored sample replaces repository names with hashes and blanks env values.
Talk to an engineer about your system
Book a free 25-minute scoping call. We tell you what we would build, what it takes to keep it running, and whether we are the right fit.