SEC475 / CLAUDE-READ-UNSAFE-PATH

SEC475 flags shared Claude settings when permissions.allow grants Read(...) over an absolute path, home-relative path, Windows drive path, or parent-traversing path.

Why It Matters

Broad read access outside the repository weakens least-privilege boundaries in shared AI policy. Even when the intent is operational convenience, absolute or parent-traversing paths make the effective trust boundary much larger than the project itself.

Trigger Shape

The rule triggers only when all of these are true:

• the file is a detected Claude settings surface
• the path is not fixture-like
• permissions.allow contains a Read(...) token whose scope is absolute, home-relative, drive-qualified, or parent-traversing

Clean Cases

These stay clean:

• repository-scoped paths such as Read(./docs/**)
• permissions that do not grant Read(...)
• fixture-like examples under test or fixture paths

Example Trigger

{
  "permissions": {
    "allow": ["Read(/etc/**)", "Read(./docs/**)"]
  }
}

Safer Example

{
  "permissions": {
    "allow": ["Read(./docs/**)"]
  }
}

How To Fix

Replace broad Read(...) path grants with repository-scoped allowlists, or remove shared access to absolute, home-relative, or parent-traversing paths from the committed Claude settings file.