Claude Code Wrote Files Outside the Repo Again?

Secure Claude Code with blockWritesOutsideWorkingDirectories. Stop files escaping the repo, add read/write boundaries, and test the limit in five minutes.

Let me start with a bad habit of mine.

I used to base my trust in Claude Code on a verbal agreement: “Don’t touch anything outside the project.” I wrote it into CLAUDE.md, and it looked convincing. Later I realized it’s only a suggestion, not a permission. If Claude really wants to write to ~/.zshrc, a neighboring project, or some temp directory, CLAUDE.md can’t stop it.

Then I saw an unassuming line in the 2.1.314 changelog:

permissions.blockWritesOutsideWorkingDirectories

The name is ridiculously long, but what it does is very direct: when Write, Edit, or NotebookEdit try to write to a path outside the working directory, Claude Code refuses outright.