From 5b5f28560d5955b5b5083c4e1b0c25d6262e7059 Mon Sep 17 00:00:00 2001 From: Emi Griffith Date: Sat, 1 Aug 2026 09:16:06 -0700 Subject: [PATCH] gitignore: ignore .claude/settings.local.json MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit It was untracked but not ignored, so a single `git add -A` would have committed one operator's local permission allowlist — including which vault secrets they may decrypt — as shared repo config. `.claude/settings.json` stays tracked as the reviewed team config. --- .gitignore | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.gitignore b/.gitignore index 5aee0f7..f5ea9c0 100644 --- a/.gitignore +++ b/.gitignore @@ -2,3 +2,9 @@ # Claude Code worktrees. These are other sessions' checkouts living inside this # repo; `git add -A` will otherwise commit them as embedded git repositories. .claude/worktrees/ + +# Per-operator Claude Code settings — local permission grants, not team config. +# Untracked but not ignored meant one `git add -A` would publish one operator's +# allowlist (including which secrets they may decrypt) to everyone. +# `.claude/settings.json` IS tracked and stays the shared, reviewed config. +.claude/settings.local.json