Why It Matters

SEC364 flags committed Claude settings that set permissions.defaultMode to bypassPermissions.

This is useful because:

• shared Claude settings in git are team-facing policy, not a one-off local override
• bypassPermissions weakens the review boundary for tool execution in a way that is hard to notice later
• narrower shared permission modes with explicit allowlists are easier for teams to audit and trust

What Triggers

This rule applies only to committed Claude settings surfaces:

• .claude/settings.json
• claude/settings.json

It triggers only on the exact structural shape:

• permissions.defaultMode = "bypassPermissions"

It does not trigger on:

• other defaultMode values
• settings files under fixture-like test/example paths
• prose or markdown references outside real Claude settings JSON

Examples

Bad:

{
  "permissions": {
    "defaultMode": "bypassPermissions",
    "allow": ["Read", "Write"]
  }
}

Better:

{
  "permissions": {
    "defaultMode": "default",
    "allow": ["Read", "Write"]
  }
}

Remediation

• replace bypassPermissions with a narrower shared permissions mode
• keep broad grants behind explicit reviewed allowlists instead of a global bypass default
• treat committed Claude settings as team policy, not as a personal local convenience file