Last week I took over a repository and asked Claude to change the login logic. It wouldn’t even read .env.example.
My first thought was that my permissions were broken. After digging around for a while, I found it wasn’t a problem on my machine. The repo contained a .claude/settings.json, and the previous maintainer had locked down .env, secrets/, and a few dangerous commands.
Honestly, I like this design. A new teammate clones the code and doesn’t need an onboarding talk about how “our team has lots of rules”. Claude sets the boundaries up front.
But the flip side is scary too. Project configuration travels with the repo, and anyone can change it. A Hook or an allow rule you casually commit could end up being executed on a colleague’s machine.
So my principle for shared team configuration is a plain one: write as little as possible, touch secrets as little as possible, and make sure someone understands every line that involves execution.
