~ / guides / guardrails

How real rigs stop agents from deleting prod

Data: 6974 public rigs · updated 2026-10-09

In 2026 several teams learned the hard way that a coding agent with a broad token and no confirmation step can wipe a production database. So we checked what people actually commit to their agent configs.

9%block destructive cmds

4%deny reading secrets

10%use a PreToolUse hook

287 rigs (4%) explicitly run in YOLO mode — bypassPermissions, a blanket Bash(*) allow, or Codex with danger-full-access.

Guardrail score distribution

0/5		5106
1/5		943
2/5		366
3/5		365
4/5		156
5/5		38

The most common deny rules

rule	rigs
Read(./.env)	84
Read(**/.env)	83
Read(~/.ssh/**)	79
Bash(rm -rf *)	73
Read(*/.pem)	67
Bash(rm -rf /)	67
Bash(git push --force:*)	67
Bash(sudo *)	64
Read(~/.aws/**)	62
Bash(rm -rf /*)	62
Read(./.env.*)	61
Read(.env)	60
Bash(git push --force*)	60
Bash(rm -rf:*)	58
Read(*/.env.)	57

Copy-paste community baseline

The destructive-command and secret-file rules that appear in 2+ rigs. Merge into .claude/settings.json:

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(**/.env)",
      "Read(~/.ssh/**)",
      "Bash(rm -rf *)",
      "Read(**/*.pem)",
      "Bash(rm -rf /)",
      "Bash(git push --force:*)",
      "Bash(sudo *)",
      "Read(~/.aws/**)",
      "Bash(rm -rf /*)",
      "Read(./.env.*)",
      "Read(.env)",
      "Bash(git push --force*)",
      "Bash(rm -rf:*)",
      "Read(**/.env.*)",
      "Read(**/*.key)",
      "Bash(sudo:*)",
      "Bash(git reset --hard*)",
      "Bash(git reset --hard:*)",
      "Read(.env.*)"
    ],
    "ask": [
      "Bash(git push:*)",
      "Bash(git push *)",
      "Bash(git commit:*)",
      "Bash(rm *)",
      "Bash(rm:*)",
      "Bash(npm publish:*)",
      "Bash(wget *)",
      "Bash(git rebase *)",
      "Bash(gh pr merge *)",
      "Bash(git commit *)"
    ]
  }
}

Deny rules are pattern-based and can be bypassed by creative shell; pair them with a sandbox and a scoped token. Most useful on top of — not instead of — least-privilege credentials.

How real rigs stop agents from deleting prod

Guardrail score distribution

The most common deny rules

Copy-paste community baseline

Fort Knox rigs to learn from