How we keep Claude Code from ever reading, editing, sourcing, or shelling out to .envrc (or any sibling like .envrc.local). Direnv files hold production secrets — once they leak into a transcript, prompt cache, or background tool call, they're effectively public. Defense-in-depth: deny rules at the permission layer, plus a PreToolUse hook that catches anything that slips past the matcher (piped commands, command substitution, novel binaries).
Drop this into .claude/settings.json (project) or ~/.claude/settings.json (user, if you want it on every machine). Two layers:
permissions.deny— blanket-denies the common file-handling tools and shells out for every reader/editor I could think of, against both.envrcand globs. Each binary gets its own entry because Claude Code matches on the command's first token.hooks.PreToolUseonBash— fail-closed regex over the resolved command string. Catches anything not enumerated above (piped readers, `xargs c