nullze/claude-code-hardened

{
  "permissions": {
    "deny": [
      "Read(~/.ssh/*)",
      "Read(~/.aws/*)",
      "Read(~/.azure/*)",
      "Read(~/.config/gcloud/*)",
      "Read(~/.kube/*)",
      "Read(~/.gnupg/*)",
      "Read(~/.netrc)",
      "Read(~/.npmrc)",
      "Read(~/.pypirc)",
      "Read(~/.gem/credentials)",
      "Read(~/.docker/config.json)",
      "Read(~/.config/gh/*)",
      "Read(~/Library/Keychains/*)",
      "Read(~/Library/Keychains/**)",
      "Read(/Library/Keychains/*)",
      "Read(/Library/Keychains/**)",
      "Read(~/Library/Application Support/1Password/*)",
      "Read(//etc/passwd)",
      "Read(//etc/shadow)",
      "Read(//etc/sudoers)",
      "Read(//etc/sudoers.d/*)",
      "Read(//private/etc/*)",
      "Read(//var/log/*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/*.pem)",
      "Read(**/*.key)",
      "Read(**/*.p12)",
      "Read(**/*.pfx)",
      "Read(**/*.jks)",
      "Read(**/*.keystore)",
      "Read(**/id_rsa*)",
      "Read(**/id_ed25519*)",
      "Read(**/terraform.tfstate*)",
      "Read(**/*.tfstate)",
      "Read(**/terraform.tfvars)",
      "Read(**/credentials.json)",
      "Read(**/credentials*)",
      "Read(**/secrets/**)",
      "Read(**/service-account*.json)",
      "Read(**/*.rdp)",
      "Read(**/*.ppk)",
      "Read(/~/.ssh/*)",
      "Read(/~/.aws/*)",
      "Read(/~/.azure/*)",
      "Read(/~/.config/gcloud/*)",
      "Read(/~/.kube/*)",
      "Read(/~/.gnupg/*)",
      "Read(/~/.netrc)",
      "Read(/~/.npmrc)",
      "Read(/~/.docker/config.json)",
      "Read(/~/.config/gh/*)",
      "Read(/~/.config/systemd/*)",
      "Read(/~/.local/share/keyrings/*)",
      "Read(//root/.ssh/*)",
      "Read(//root/.aws/*)",
      "Read(//root/.kube/*)",
      "Read(//root/.gnupg/*)",
      "Read(//proc/*/environ)",
      "Read(//proc/*/cmdline)",
      "Read(//etc/crontab)",
      "Read(//etc/cron.d/*)",
      "Read(//etc/systemd/system/*)",
      "Read(//var/spool/cron/*)",
      "Read(//c~/.ssh/*)",
      "Read(//c~/.aws/*)",
      "Read(//c~/.azure/*)",
      "Read(//c~/.config/gcloud/*)",
      "Read(//c~/.kube/*)",
      "Read(//c~/.gnupg/*)",
      "Read(//c~/.docker/config.json)",
      "Read(//c~/.npmrc)",
      "Read(//c~/.netrc)",
      "Read(//c~/AppData/Roaming/Microsoft/Credentials/*)",
      "Read(//c~/AppData/Local/Microsoft/Credentials/*)",
      "Read(//c~/AppData/Roaming/Microsoft/Windows/Credentials/*)",
      "Read(//c~/AppData/Roaming/GitHub CLI/*)",
      "Read(//c~/AppData/Local/1Password/*)",
      "Read(//c~/AppData/Roaming/1Password/*)",
      "Read(//c~/AppData/Roaming/Bitwarden/*)"
    ]
  },
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": "bash -c 'CMD=$(cat | jq -r \".tool_input.command // empty\"); if [ -z \"$CMD\" ]; then exit 0; fi; PATTERNS=\"(^|[;\\&\\|\\`\\$\\(])\\s*(curl|wget|nc|netcat|ncat|socat|ssh|scp|rsync|telnet|ftp|sftp|nmap)\\b\" ; PATTERNS2=\"(^|[;\\&\\|\\`\\$\\(])\\s*(sudo|su|do"
          }
        ]
      }
    ]
  }
}