Why It Matters

SEC374 flags committed Claude settings files when permissions.allow contains the exact wildcard search grant WebSearch(*).

This is useful because:

• shared Claude settings often become team-wide defaults by copy/paste
• WebSearch(*) grants broad search capability instead of a reviewed allowlist
• broad search access is harder to defend in code review when a workflow only needs a narrow, documented search surface

What Triggers

This rule applies only to committed Claude settings surfaces:

• .claude/settings.json
• claude/settings.json

It triggers when:

• permissions.allow contains the exact string WebSearch(*)

It does not trigger on:

• narrower reviewed patterns such as WebSearch(site:docs.example.com)
• fixture-like test/example paths

Examples

Bad:

{
  "permissions": {
    "allow": ["WebSearch(*)", "Read(*)"]
  }
}

Better:

{
  "permissions": {
    "allow": ["WebSearch(site:docs.example.com)", "Read(*)"]
  }
}

Remediation

• replace WebSearch(*) with specific reviewed search patterns
• scope shared search permissions to the narrowest set of queries or domains the workflow actually needs