Directory / Claude Code
Claude Code
Deny-first permission rules, PreToolUse hooks that can block even in bypass mode, and an OS-level Bash sandbox with domain allowlists. The sandbox only covers shell commands; file tools and MCP servers sit outside it.
Lock this down first
Turn on the Bash sandbox with strictAllowlist, and never use --dangerously-skip-permissions outside a container or VM.
Scorecard
| Criterion | Rating | Notes |
|---|---|---|
| Permission granularity | 3/3 | |
| Human approval gates | 3/3 | |
| Sandboxing | 2/3 | OS sandbox covers Bash only. Docs recommend a container or VM for unattended runs. |
| Secrets handling | 2/3 | Keychain on macOS, 0600 file on Linux. apiKeyHelper for custom credential scripts. |
| Audit logs | 2/3 | OpenTelemetry metrics and log events, opt-in. ConfigChange hooks can audit settings changes. |
| Kill switch / interrupt | 3/3 | Esc stops the current tool call, Ctrl+C interrupts, Ctrl+X Ctrl+K stops background subagents. |
| Network egress control | 3/3 | allowedDomains plus strictAllowlist for sandboxed commands. |
Sources
- https://code.claude.com/docs/en/permissions
- https://code.claude.com/docs/en/sandboxing
- https://code.claude.com/docs/en/sandbox-environments
- https://code.claude.com/docs/en/hooks
- https://code.claude.com/docs/en/interactive-mode
- https://code.claude.com/docs/en/monitoring-usage
- https://code.claude.com/docs/en/authentication
- https://code.claude.com/docs/en/security