feat: harden claude settings with permissions, sandbox, outputStyle, and allowlist - #862
Conversation
- Set outputStyle to Proactive - Add ask rules for settings.json and .env files - Add deny rules for credential files (~/.aws, ~/.ssh, ~/.gcp, ~/.azure, ~/.gnupg, ~/.netrc, ~/.docker/config.json, ~/.kube) - Add sandbox credentials block mirroring deny rules for bash subprocess protection - Add sandbox network allowedDomains (*.ai, *.com, *.dev, *.io, *.net, *.org) - Exclude docker from sandbox (incompatible) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Add ~/.cargo, ~/Library/Python, ~/go/pkg to sandbox filesystem allowWrite - Add *.co to sandbox network allowedDomains Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 39 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Claude settings template gains an ChangesClaude Settings Configuration
Estimated code review effort: 3 (Moderate) | ~20 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ BASH | shfmt | 3 | 0 | 0 | 0 | 0.02s |
| prettier | 8 | 0 | 1 | 0 | 0.42s | |
| markdownlint | 6 | 0 | 2 | 0 | 0.56s | |
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.16s |
| ✅ YAML | prettier | 10 | 0 | 0 | 0 | 0.53s |
Detailed Issues
⚠️ MARKDOWN / markdownlint - 2 errors
chezmoi/private_dot_claude/modify_CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
chezmoi/private_dot_config/opencode/modify_AGENTS.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
⚠️ JSON / prettier - 1 error
chezmoi/.chezmoitemplates/claude-settings.json 91ms (unchanged)
chezmoi/.chezmoitemplates/opencode-tui.json 2ms (unchanged)
chezmoi/.chezmoitemplates/opencode.json 5ms (unchanged)
[error] chezmoi/private_dot_claude/modify_settings.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
chezmoi/private_dot_config/mcp/mcp_servers.json 4ms (unchanged)
[error] chezmoi/private_dot_config/opencode/modify_opencode.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_tui.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
renovate.json 4ms (unchanged)
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters BASH_SHFMT,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,YAML_PRETTIER
Show us your support by starring ⭐ the repository
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Claude settings template (claude-settings.json) to define permissions, sandbox configurations, and network rules. The review feedback highlights critical security improvements: restricting the overly permissive wildcard network domains in allowedDomains to a strict allowlist of trusted domains, and adding missing developer credential files (such as .npmrc, .pypirc, and .git-credentials) to both the permissions.deny and sandbox.credentials.files lists to prevent potential data exfiltration.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ BASH | bash-exec | 3 | 0 | 0 | 0.01s | |
| ✅ BASH | shellcheck | 3 | 0 | 0 | 0.12s | |
| ✅ REPOSITORY | checkov | yes | no | no | 24.74s | |
| ✅ REPOSITORY | devskim | yes | no | no | 2.0s | |
| ✅ REPOSITORY | dustilock | yes | no | no | 0.02s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 1.48s | |
| ✅ REPOSITORY | grype | yes | no | no | 50.2s | |
| ✅ REPOSITORY | kingfisher | yes | no | no | 9.94s | |
| osv-scanner | yes | 1 | no | 0.16s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.84s | |
| ✅ REPOSITORY | syft | yes | no | no | 2.23s | |
| ✅ REPOSITORY | trivy | yes | no | no | 10.92s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.12s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 4.51s |
Detailed Issues
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
End status: 41 dirs visited, 139 inodes visited, 0 Extract calls, 2.98469ms elapsed, 2.98488ms wall time
No package sources found, --help for usage information.
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters BASH_EXEC,BASH_SHELLCHECK,REPOSITORY_CHECKOV,REPOSITORY_DEVSKIM,REPOSITORY_DUSTILOCK,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,REPOSITORY_KINGFISHER
Show us your support by starring ⭐ the repository
✅
|
| Descriptor | Linter | Files | Fixed | Errors | Warnings | Elapsed time |
|---|---|---|---|---|---|---|
| ✅ ACTION | actionlint | 5 | 0 | 0 | 0.29s | |
| ✅ ACTION | zizmor | 5 | 0 | 0 | 0 | 0.54s |
| ✅ BASH | bash-exec | 3 | 0 | 0 | 0.01s | |
| ✅ BASH | shellcheck | 3 | 0 | 0 | 0.13s | |
| ✅ BASH | shfmt | 3 | 0 | 0 | 0 | 0.01s |
| ✅ COPYPASTE | jscpd | yes | no | no | 1.0s | |
| ✅ EDITORCONFIG | editorconfig-checker | 67 | 0 | 0 | 0.13s | |
| prettier | 8 | 0 | 1 | 0 | 0.64s | |
| ✅ JSON | v8r | 8 | 0 | 0 | 3.66s | |
| markdownlint | 6 | 0 | 2 | 0 | 0.72s | |
| ✅ MARKDOWN | markdown-table-formatter | 6 | 0 | 0 | 0 | 0.35s |
| ✅ REPOSITORY | checkov | yes | no | no | 24.85s | |
| ✅ REPOSITORY | gitleaks | yes | no | no | 1.62s | |
| ✅ REPOSITORY | git_diff | yes | no | no | 0.01s | |
| ✅ REPOSITORY | grype | yes | no | no | 49.28s | |
| osv-scanner | yes | 1 | no | 0.21s | ||
| ✅ REPOSITORY | secretlint | yes | no | no | 1.44s | |
| ✅ REPOSITORY | syft | yes | no | no | 3.08s | |
| ✅ REPOSITORY | trivy | yes | no | no | 11.85s | |
| ✅ REPOSITORY | trivy-sbom | yes | no | no | 0.2s | |
| ✅ REPOSITORY | trufflehog | yes | no | no | 5.31s | |
| lychee | 24 | 2 | 0 | 1.21s | ||
| ✅ YAML | prettier | 10 | 0 | 0 | 0 | 0.67s |
| ✅ YAML | v8r | 10 | 0 | 0 | 8.18s | |
| ✅ YAML | yamllint | 10 | 0 | 0 | 0.67s |
Detailed Issues
⚠️ SPELL / lychee - 2 errors
📝 Summary
---------------------
🔍 Total...........21
🔗 Unique..........16
✅ Successful......19
⏳ Timeouts.........0
🔀 Redirected.......4
👻 Excluded.........0
❓ Unknown..........0
🚫 Errors...........2
⛔ Unsupported......2
Errors in chezmoi/.chezmoitemplates/opencode.json
[406] https://mcp.deepwiki.com/mcp (at 23:15) | Rejected status code: 406 Not Acceptable
Errors in chezmoi/private_dot_config/mcp/mcp_servers.json
[406] https://mcp.deepwiki.com/mcp (at 11:15) | Rejected status code: 406 Not Acceptable
Hint: Followed 4 redirects. You might want to consider replacing redirecting URLs with the resolved URLs. Use verbose mode (`-v`/`-vv`) to see redirection details.
Hint: You can configure accepted/rejected response codes with `-a` or `--accept`
⚠️ MARKDOWN / markdownlint - 2 errors
chezmoi/private_dot_claude/modify_CLAUDE.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
chezmoi/private_dot_config/opencode/modify_AGENTS.md:1 error MD041/first-line-heading/first-line-h1 First line in a file should be a top-level heading [Context: "{{- /*chezmoi:modify-template*..."]
⚠️ REPOSITORY / osv-scanner - 1 error
Scanning dir .
Starting filesystem walk for root: /
End status: 41 dirs visited, 139 inodes visited, 0 Extract calls, 3.163226ms elapsed, 3.163435ms wall time
No package sources found, --help for usage information.
⚠️ JSON / prettier - 1 error
chezmoi/.chezmoitemplates/claude-settings.json 121ms (unchanged)
chezmoi/.chezmoitemplates/opencode-tui.json 2ms (unchanged)
chezmoi/.chezmoitemplates/opencode.json 7ms (unchanged)
[error] chezmoi/private_dot_claude/modify_settings.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
chezmoi/private_dot_config/mcp/mcp_servers.json 5ms (unchanged)
[error] chezmoi/private_dot_config/opencode/modify_opencode.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
[error] chezmoi/private_dot_config/opencode/modify_tui.json: SyntaxError: Unexpected token (1:2)
[error] > 1 | {{- /* chezmoi:modify-template */ -}}
[error] | ^
[error] 2 | {{- $current := dict -}}
[error] 3 | {{- if .chezmoi.stdin | trim -}}
[error] 4 | {{- $current = fromJson .chezmoi.stdin -}}
renovate.json 3ms (unchanged)
Notices
📣 MegaLinter 9.5.0 is out! Discover the new features and security recommendations in the release announcement. (Skip this info by defining SECURITY_SUGGESTIONS: false)
See detailed reports in MegaLinter artifacts
Your project could benefit from a custom flavor, which would allow you to run only the linters you need, and thus improve runtime performances. (Skip this info by defining FLAVOR_SUGGESTIONS: false)
- Documentation: Custom Flavors
- Command:
npx mega-linter-runner@9.5.0 --custom-flavor-setup --custom-flavor-linters ACTION_ACTIONLINT,ACTION_ZIZMOR,BASH_EXEC,BASH_SHELLCHECK,BASH_SHFMT,COPYPASTE_JSCPD,EDITORCONFIG_EDITORCONFIG_CHECKER,JSON_V8R,JSON_PRETTIER,MARKDOWN_MARKDOWNLINT,MARKDOWN_MARKDOWN_TABLE_FORMATTER,REPOSITORY_CHECKOV,REPOSITORY_GIT_DIFF,REPOSITORY_GITLEAKS,REPOSITORY_GRYPE,REPOSITORY_OSV_SCANNER,REPOSITORY_SECRETLINT,REPOSITORY_SYFT,REPOSITORY_TRIVY,REPOSITORY_TRIVY_SBOM,REPOSITORY_TRUFFLEHOG,SPELL_LYCHEE,YAML_PRETTIER,YAML_YAMLLINT,YAML_V8R
Show us your support by starring ⭐ the repository
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 5
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@chezmoi/.chezmoitemplates/claude-settings.json`:
- Around line 87-94: The allowedDomains allowlist is too broad because it uses
TLD-wide wildcards like *.com and *.net; tighten the policy by replacing those
entries in claude-settings.json with only the exact trusted domains the
toolchain actually needs. Update the allowedDomains list in the template so it
contains specific hostnames rather than broad wildcard patterns.
- Line 71: Update the sandbox command exclusion in the claude-settings template
so the excludedCommands entry matches Docker subcommands, not just the base
command. In the JSON template, change the excludedCommands list near the sandbox
configuration to use the Docker wildcard pattern so invocations like docker
build and docker compose are covered, and keep the change localized to the
existing excludedCommands setting.
- Around line 59-70: Add sandbox environment variable denies alongside the
existing credentials.files block in claude-settings.json, since file-based
restrictions alone do not prevent secret env vars from being inherited by
sandboxed commands. Update the credentials configuration to include
sandbox.credentials.envVars entries for sensitive tokens such as GITHUB_TOKEN
and any similar secret variables used by this template, keeping the existing
deny pattern consistent with the current credentials section.
- Around line 57-58: The Claude Code sandbox settings are too permissive because
the config can continue without sandboxing and weak network isolation is enabled
by default. Update the claude-settings.json template to make the sandbox fail
closed by setting failIfUnavailable to true in the same sandbox config block,
and turn off enableWeakerNetworkIsolation unless the macOS workaround is
explicitly needed. Keep the change anchored in the sandbox-related settings
alongside the existing enabled flag.
- Around line 73-84: The allowWrite list in the claude-settings template is too
broad because it grants write access to entire tool home directories. Narrow the
entries in the claude-settings JSON template so each path points only to the
specific cache/store subpaths needed by the sandbox, and update the allowWrite
values accordingly while keeping the same section in the template.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: dd7b0621-214a-4f94-8055-7797834cabb0
📒 Files selected for processing (1)
chezmoi/.chezmoitemplates/claude-settings.json
- Widen ~/.docker/config.json deny to ~/.docker/** (permissions) and ~/.docker (sandbox) to cover full directory - Add missing credential files: ~/.npmrc, ~/.pypirc, ~/.git-credentials - Add ~/.local to sandbox allowWrite for Linux pip/user installs - Remove network.allowedDomains from template (managed separately) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
- Fix excludedCommands: ["docker"] -> ["docker *"] to match subcommands - Add missing credential paths: ~/.cargo/credentials, ~/.gem/credentials, ~/.config/gh - Add sandbox.credentials.envVars to deny AWS/GitHub/npm/PyPI tokens - Skip: allowedDomains TLD narrowing (intentional trade-off for prompt reduction) - Skip: failIfUnavailable (personal machine, sandbox may not always be available) - Skip: enableWeakerNetworkIsolation (needed for gh/gcloud TLS on macOS) - Skip: allowWrite narrowing (cache paths need full dir access for tooling) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
|
/gemini review |
There was a problem hiding this comment.
Code Review
This pull request updates the Claude settings template (claude-settings.json) by setting the output style to "Proactive", defining explicit permission rules for editing and reading sensitive environment files, and configuring sandbox settings to deny access to credentials and specific environment variables. Feedback on these changes suggests adding the missing sandbox.network.allowedDomains configuration mentioned in the PR description, and narrowing down the overly broad wildcard patterns for **/credentials* and **/secrets* in both the Edit and Read rules to avoid blocking legitimate source files.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
| "Edit(**/credentials*)", | ||
| "Edit(**/secrets*)", |
There was a problem hiding this comment.
Using **/credentials* and **/secrets* as wildcards is overly broad and can lead to unintended consequences. For example, they will match and block legitimate source code files like secrets.py (which is also a Python standard library module name), credentials.go, or secrets_helper.ts in codebases Claude is working on.
It is highly recommended to use more specific patterns (e.g., targeting specific file extensions or directory paths like **/secrets/** or **/credentials.json) to avoid blocking legitimate development work.
| "Edit(**/credentials*)", | |
| "Edit(**/secrets*)", | |
| "Edit(**/credentials)", | |
| "Edit(**/credentials.json)", | |
| "Edit(**/secrets/**)", |
| "Read(**/credentials*)", | ||
| "Read(**/secrets*)", |
There was a problem hiding this comment.
Similarly to the Edit rules, using **/credentials* and **/secrets* for Read rules is overly broad and will block Claude from reading legitimate source files like secrets.py or credentials.go.
Consider refining these to more specific patterns like **/credentials, **/credentials.json, or **/secrets/**.
| "Read(**/credentials*)", | |
| "Read(**/secrets*)", | |
| "Read(**/credentials)", | |
| "Read(**/credentials.json)", | |
| "Read(**/secrets/**)", |
- ~/.cargo -> ~/.cargo/registry (excludes ~/.cargo/bin from PATH) - ~/.local -> ~/.local/lib (excludes ~/.local/bin from PATH) Co-Authored-By: Claude Sonnet 4.6 (1M context) <noreply@anthropic.com>
1 participant
Summary
outputStyletoProactivefor autonomous executionpermissions.askrules for settings files and.envfilespermissions.denyrules for credential locations (~/.aws,~/.ssh,~/.gcp,~/.azure,~/.gnupg,~/.netrc,~/.docker/config.json,~/.kube)sandbox.credentialsblock mirroring deny rules for OS-level bash subprocess protectionsandbox.network.allowedDomainscovering common TLDs (*.ai,*.co,*.com,*.dev,*.io,*.net,*.org)dockerfrom sandbox (incompatible per docs)sandbox.filesystem.allowWritewith~/.cargo,~/Library/Python,~/go/pkgTest plan
chezmoi applyand verify~/.claude/settings.jsonis updated correctly.envreads and settings.json edits~/.ssh/,~/.aws/)🤖 Generated with Claude Code
Summary by CodeRabbit