From 509ed85fb2c07bb3d54eb0b7e7a3805a03abe427 Mon Sep 17 00:00:00 2001
From: Kevin Veen-Birkenbach <kevin@veen.world>
Date: Tue, 7 Jul 2026 09:21:59 +0200
Subject: [PATCH] chore(claude): sandbox bash, deny git push/commit

---
 .claude/settings.json | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 0000000..6965f2f
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,20 @@
+{
+  "permissions": {
+    "defaultMode": "dontAsk",
+    "deny": [
+      "Bash(git push)",
+      "Bash(git push:*)",
+      "Bash(git commit)",
+      "Bash(git commit:*)",
+      "Bash(git -C * push)",
+      "Bash(git -C * push:*)",
+      "Bash(git -C * commit)",
+      "Bash(git -C * commit:*)"
+    ]
+  },
+  "sandbox": {
+    "enabled": true,
+    "autoAllowBashIfSandboxed": true,
+    "allowUnsandboxedCommands": false
+  }
+}