This is especially tricky because, if you do any customization on your Claude Code setup (which you should!), you'll end up with stuff in .claude/ that legitimately belongs in the repo. For example, one of my projects has an PostToolUse edit hook that runs ruff and pyright on edited Python files, and a Stop hook that runs them across the whole repo and also runs the test suite. This is project infrastructure. Another dev who clones the repo and starts up Claude Code should have the same quality checks enforced.
Ideally, there would be a separate file in .claude/ where the "allow" commands get stored, and we could .gitignore that one file. Unfortunately, right now they get dumped into .claude/settings.json along with hooks and everything else.
The simplest solution is to add `.claude/` to your .gitignore file. This is 100% effective and safe. Unless you've already committed sensitive data, in which case you'll have to purge that data from your repo, which is one of many painful rites of passage for a software developer.
If you have a custom .claude/ setup that you want to include in the repo, then I'd suggest either using Claude Code in "auto" mode, or writing your own hook that security-checks each command, so you don't have to click "Allow" every time Claude wants to do anything (because you *will* end up clicking without looking).
This is especially tricky because, if you do any customization on your Claude Code setup (which you should!), you'll end up with stuff in .claude/ that legitimately belongs in the repo. For example, one of my projects has an PostToolUse edit hook that runs ruff and pyright on edited Python files, and a Stop hook that runs them across the whole repo and also runs the test suite. This is project infrastructure. Another dev who clones the repo and starts up Claude Code should have the same quality checks enforced.
Ideally, there would be a separate file in .claude/ where the "allow" commands get stored, and we could .gitignore that one file. Unfortunately, right now they get dumped into .claude/settings.json along with hooks and everything else.
So what about countermeasures for inviduals, thanks for the research btw
The simplest solution is to add `.claude/` to your .gitignore file. This is 100% effective and safe. Unless you've already committed sensitive data, in which case you'll have to purge that data from your repo, which is one of many painful rites of passage for a software developer.
If you have a custom .claude/ setup that you want to include in the repo, then I'd suggest either using Claude Code in "auto" mode, or writing your own hook that security-checks each command, so you don't have to click "Allow" every time Claude wants to do anything (because you *will* end up clicking without looking).