1 in 6 public Claude Code configs contains a permission rule that does nothing

I'll pull the source gist so the paragraphs stick to documented facts only.A public audit by **sfox100** found that **1 in 6** public **Claude Code** configs ships a permission rule that never fires. Across **149** public `.claude/settings.json` files on GitHub (**134** with permission rules, **3,132** rules total), **21 of 134 configs (16%)** held at least one dead path rule — **50** dead rules in all. The finding was published as a gist, reported upstream on **anthropics/claude-code#75315**, and surfaced on Hacker News with **1** point and **0** comments at listing time.

Claude Code file permission checks only consult **Edit(path)** and **Read(path)** rules. Path rules on **Write**, **Glob**, **NotebookEdit**, or the legacy **MultiEdit** are accepted and never matched. A real public pattern like `deny: ["Write($HOME/.ssh)", "Write(**/*.pem)"]` protects nothing; the working form is **Edit($HOME/.ssh)**, which covers the write-family tools. The behaviour is documented in the permissions docs and the **v2.1.210** changelog, and recent versions print a startup warning naming the rule and the fix. Verification was against **Claude Code v2.1.220** (August 2026).

Of the **50** dead rules, **34** sat next to a working **Edit**/**Read** twin — clutter, not an open hole. The other **16** had no twin, so the intended guardrail was simply not active. **8** of those were **deny** rules aimed at credentials (`.ssh`, `.kube`, `.aws`, `secrets/`, `*.pem`, `*.key`). One config used `deny: Write(rm -rf *)` — a Bash-shaped rule on a file tool that no warning catches. Builders who treat permission config as the real control plane for autonomous agents can believe SSH keys and certificates are write-protected when they are not.

The misconfiguration persists because the warning only reaches a useful place in some surfaces. Interactive CLI keeps it in scrollback. Piped or CI runs (`2>/dev/null`) route it to a debug log by design. The VS Code extension surfaces it only under View → Output → "Claude VSCode", and the CLI **[WARN]** is downgraded to an **[info]** line with no toast or panel banner (checked live on **v2.1.220**). The Agent SDK gives no warning. That stack of choices leaves extension, script, CI, and SDK users with dead credential rules and no signal.

Convert **Write**/**Glob**/**NotebookEdit**/**MultiEdit(path)** rules to **Edit(path)** for the write family and **Read(path)** for Glob. Remember path syntax: a single leading `/` is project-relative, `//` is absolute, `~/` is home. Write-capable **allow** rules into `.git`, `.claude`, `.vscode` and similar are inert because the protected-path check runs first. **sfox100** published **claude-permission-audit** — zero dependencies, exit **1** on findings for CI — which also reports the twin analysis the startup warning does not: which dead rules are clutter and which are unprotected guardrails. Watch whether Anthropics hardens warning delivery outside interactive CLI, and audit any shared or CI-driven Claude Code config that still uses Write-shaped path denies.