[BUG] .claudeignore does not prevent Claude from reading ignored files

Preflight Checklist

I have searched existing issues and this hasn't been reported yet
This is a single bug report (please file separate reports for different bugs)
I am using the latest version of Claude Code

What's Wrong?

The .claudeignore file is documented as a way to exclude files from Claude's context. However, Claude would appear to still be able to explicitly read files listed in .claudeignore (possibly using a read tool?), effectively bypassing the ignore rules.

What Should Happen?

Claude appears to read ignored files even if those files are listed in .claudeignore.

This makes the feature unreliable for excluding certain files.

Impact:
Users relying on .claudeignore to protect files have no real guarantee that those files are excluded from context.

This behavior has been observed both when using Claude from the terminal and via the VS Code extension.

Error Messages/Logs

Steps to Reproduce

Add examplefile.json to .claudeignore 2. Ask Claude to show one of files listed in claudeignore 3. Claude reads and displays the content of file

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

No response

Claude Code Version

2.1.79

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

This issue was observed while using Claude through the monthly subscription, not the Anthropic API. Specifically, it occurs when using Claude from the terminal and the VS Code extension.

The .claudeignore file was placed in the root of the project and was recognized by Claude.

Found 3 possible duplicate issues:

This issue will be automatically closed as a duplicate in 3 days.

If your issue is a duplicate, please close it and 👍 the existing issue instead
To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

This is really annoying. Also it is not clear when claude code will ask for read permission and when it is just reading files out of the blue.

The .claudeignore file is documented as a way to exclude files from Claude's context.

Can you link me the official documentation?

@matt-savvy

came here to report the same.
@matt-savvy if you ask claude (on web) example "how do i restrict claude code from reading .env", it would reply with
In Claude Code, add a .claudeignore file in your project root. Claude Code respects this file and will not read, reference, or suggest changes to anything listed in it — same concept as .gitignore.

and when i asked can i add this globally?
it even suggested further

Yes. Create the file at:
~/.claude/.claudeignore
This applies across all projects without needing a .claudeignore in each one.

@matt-savvy if you ask claude (on web) example "how do i restrict claude code from reading .env", it would reply with In Claude Code, add a .claudeignore file in your project root. Claude Code respects this file and will not read, reference, or suggest changes to anything listed in it — same concept as .gitignore.

and when i asked can i add this globally? it even suggested further
Yes. Create the file at:
~/.claude/.claudeignore
This applies across all projects without needing a .claudeignore in each one.

That's not what I asked about though. I just wanted to see the Claude Code documentation about this.

I am having the same issue. Claude subagents will ignore the .claudeignore to pull sensitive data into the thread

In official docs , I don't see any mention of .claudeignore file being supported
This is supported via third party hook - https://github.com/li-zhixin/claude-ignore

In official docs , I don't see any mention of .claudeignore file being supported This is supported via third party hook - https://github.com/li-zhixin/claude-ignore

Almost as if this is not a feature of Claude Code

I am having the same issue. Claude subagents will ignore the .claudeignore to pull sensitive data into the thread

I am experiencing the same issue.

I first heard about the .claudeignore file on LinkedIn. I thought I'd search for the official documentation and found nothing except this closed GitHub issue from more than a year ago, where a contributor explicitly suggests using 'deny permission rules':

#579

guys are we all hallucinating config files?

guys are we all hallucinating config files?

Yes

Regardless if this is actually a feature, the file reading is inconsistent as hell. Sometimes the model pops-up dialogs for every single read and sometimes it just uses file-tools to ingest multiple files without asking. File permissions should never be governed by model decisions, but by algorithmic solutions.

I also have the same issue and have seen it a number of times. My .env is in both .gitignore and .claudeignore when asking Claude Code to tell me what it did earlier in the thread it knows it read the file (I saw it do that too) and it says that the ignore files are not enforced. That seems to be an oversight.

I'm leveraging the CLAUDE.md rules section to understand what the file is. Until a fix is in place.

Add the following rule:

...

### Rules

- If `.claudeignore` file exists, files and directories listed in the file should be completely ignored. Only ready the `.claudeignore` to get that list of files and directories to be ignored and not read. The format of this file follow the same syntax used in the `.gitignore`. 

...

Example:

❯ I have a .claudeignore file can you tell me the contents of the file

  Read 1 file (ctrl+o to expand)

● The .claudeignore contains two entries:

  - .env
  - private-notes.md

  These files will be ignored — I won't read them or factor them into any decisions.

❯ I have a private-notes.md file can you tell me the contents of the file

● No — private-notes.md is listed in .claudeignore, so I won't read it.

❯ what is the syntax used in the .claudeignore, if I wanted to block a specific filename in all directories what syntax would I use.

● .claudeignore follows .gitignore syntax. To block a specific filename in all directories, just use the bare filename with no path prefix:

  secret.txt

  This matches secret.txt anywhere in the directory tree — root, subdirectories, nested folders, etc.

  Other useful patterns:
  - *.env — any file ending in .env everywhere
  - **/secret.txt — explicit "any depth" (same effect as the bare name)
  - config/secret.txt — only that exact path from the repo root
  - secrets/ — an entire directory named secrets anywhere

@ttamg

@ttamg it is not an oversight, the feature doesn't exist and your agent is hallucinating.

I can confirm this bug on macOS with the VS Code extension (Claude Code).

My .claudeignore contained .env, yet Claude read the file without any warning or permission prompt.

I tested this across multiple new sessions and the behavior is consistent: .claudeignore does not prevent the Read tool from accessing listed files.

chmod 600 .env also did not help, as Claude Code runs as the same OS user as the file owner.

This is a serious security issue. Users reasonably expect .claudeignore to act as an access boundary, not just an autocomplete hint. The documentation should clearly state this limitation until it is fixed - or the Read tool should actually respect .claudeignore.

Environment: macOS, VS Code extension, Claude Sonnet 4.6

Move .env outside the project directory (one level up) and start for example dev server with:

npx dotenv-cli -e .env -- yarn --cwd app dev

This keeps .env outside Claude Code's working directory entirely, so it won't be accessible regardless of .claudeignore behavior.

For npm users:

npx dotenv-cli -e ../.env -- npm run dev

In my opinion it it the only safe solution.

Additional security tips:

Do not mention anywhere in the repository how you load .env (not in README, package.json, or any other file) - Claude reads all files in the working directory and can use that information to locate secrets outside the project
Never grant Claude access to directories outside your project's working directory - this prevents it from executing Read on files in parent folders even if it somehow learns the path

OK an update as I did a load more testing and research.

Confirming it is the case that .claudeignore is 'not a thing'. Not official or enforced at all. Indeed it is a common hallucination of the models used in Claude Code. Specifically it doesn't do anything in the harness. Do a search for .claudeignore in this repo if you don't believe me
So .claudeignore is only used by the LLM if it actually sees it. It is a very weak guard-rail. Having an LLM do its own guard-railing for .env and other files is very bad practice. We need guard-railing in the harness instead (Claude Code codebase itself)
There are a lot of ways using bash to access a .env file when you are running as the user and from my testing something along the following lines as a prevent mostly works. What is good is that it is part of the harness so more reliable. This is a workaround for now.
It would much more reliable if Claude Code to implement something like this instead of us doing it for each repo so I would encourage Claude Code to add blacklisting in the harness so that certain files are truly ignored. But given how many open issues there are in this repo I suspect it won't happen any time soon. Better still might be to have claude run as a different user with permissions we can then set.

Examples of the sort of preventions you can add to the the .claude/settings.json file to try to stop the tool calls reading your secret files. This is better than what we had but cannot be fully relied upon.

  "hooks": {},
  "permissions": {
    "allow": [],
    "deny": [
      "Bash(cat .env*)",
      "Bash(cat .keys/*)",
      "Bash(cat *secret*)",
      "Bash(cat *credential*)",
      "Bash(cat *token*)",
      "Bash(less .env*)",
      "Bash(more .env*)",
      "Bash(head .env*)",
      "Bash(tail .env*)",
      "Bash(sed * .env*)",
      "Bash(awk * .env*)",
      "Bash(grep * .env*)",
      "Bash(python* *.env*)",
      "Bash(python* *open*.env*)",
      "Bash(echo $*KEY*)",
      "Bash(echo $*SECRET*)",
      "Bash(echo $*TOKEN*)",
      "Bash(echo $*PASSWORD*)",
      "Bash(printenv)",
      "Bash(env)",
      "Bash(set)",
      "Read(**/.env)",
      "Read(*.pem)",
      "Read(*.key)",
      "Read(~/.ssh/**)"
    ]
  }
}

Closing for now — inactive for too long. Please open a new issue if this is still relevant.

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.

Navigation Menu

Repository navigation

[BUG] .claudeignore does not prevent Claude from reading ignored files #36163

Preflight Checklist

What's Wrong?

What Should Happen?

Error Messages/Logs

Steps to Reproduce

Claude Model

Is this a regression?

Last Working Version

Claude Code Version

Platform

Operating System

Terminal/Shell

Additional Information

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[BUG] .claudeignore does not prevent Claude from reading ignored files #36163

Description

Preflight Checklist

What's Wrong?

What Should Happen?

Error Messages/Logs

Steps to Reproduce

Claude Model

Is this a regression?

Last Working Version

Claude Code Version

Platform

Operating System

Terminal/Shell

Additional Information

Activity

github-actions commented on Mar 19, 2026

Madsim commented on Mar 20, 2026

matt-savvy commented on Mar 24, 2026

vasuchawla commented on Mar 25, 2026

matt-savvy commented on Mar 25, 2026

rjluebbert commented on Mar 29, 2026

swapnildukare commented on Apr 2, 2026

matt-savvy commented on Apr 2, 2026

jaerith commented on Apr 2, 2026

jasonb-occasio commented on Apr 6, 2026

matt-savvy commented on Apr 6, 2026

Madsim commented on Apr 6, 2026

ttamg commented on Apr 12, 2026

whitehatmiddleman commented on Apr 17, 2026

iuriguilherme commented on Apr 18, 2026

kriss145 commented on Apr 18, 2026

kriss145 commented on Apr 19, 2026

ttamg commented on Apr 19, 2026

github-actions commented on May 26, 2026

github-actions commented on Jul 22, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions