Claude Code permissions tested: Read(./.env) and Bash(git push *) leak

The line is drawn between CLAUDE.md, which it calls a request to Claude, and permissions, which Claude Code enforces on its own before an action runs. That distinction matters because the default has shifted: from v2.1.283, terminal and VS Code sessions start in Auto mode, where a separate classifier approves actions instead of the user, so the confirmation dialog most users used to see rarely appears. Choosing "don't ask again" in that dialog quietly adds allow rules—for Bash commands and web fetches they persist in .claude/settings.local.json for the repository, while file-edit approvals last only until the session ends. Opening the permissions list shows how many such rules have accumulated. The test results themselves set the limits: the .env deny held against the read tool and cat but not against a Python one-liner or a filename-less grep, and denial was verified in deny mode because the ask dialog could not be reproduced automatically. For git push, commands joined with && and prefixed with timeout were still caught, but git -C, git -c push.default=current, and git 'push' were not. What happens to a command that slips through then depends on the mode—Manual shows its normal confirmation, Auto leaves it to the classifier—and hooks' PreToolUse can inspect commands with a custom script. The sandbox, off by default, is offered as the OS-level backstop for script-based reads.