Why It Matters

SEC361 flags committed Claude settings files that omit a top-level $schema reference.

This is useful because:

• shared .claude/settings.json files are configuration artifacts, not free-form notes
• a schema reference improves editor validation and makes team-owned settings easier to review
• the failure mode is community-hostile: the file looks authoritative, but misses a low-cost interoperability hint that many users expect in checked-in JSON config

Positioning

This is a compat rule, not a headline security finding. The signal is about shared config correctness and reviewer ergonomics on team-owned Claude settings.

What Triggers

This rule applies only to committed Claude settings surfaces:

• .claude/settings.json
• claude/settings.json

It triggers when:

• the JSON parses as a top-level object
• and the object does not contain $schema

Example that triggers:

{
  "hooks": {
    "Stop": []
  }
}

Example that stays clean:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "hooks": {
    "Stop": []
  }
}

• fixture-like paths under tests/, fixtures/, examples/, or samples/

False Positives

Some repositories intentionally keep Claude settings minimal or target editor setups without schema-aware validation. The signal is about deterministic configuration quality and maintainability, not about exploitability, which is why it now belongs in the compat lane rather than the main security preview lane.

Remediation

Add the top-level SchemaStore URL:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json"
}

Keep the rest of the settings file unchanged. The goal is to make shared Claude settings easier to validate and review, not to change runtime behavior.