env-file-protection — Claude Code hook: block writes to .env
This hook stops Write calls aimed at .env* files, so an agent cannot overwrite your secrets by accident. One command adds it to Claude settings.
npx claude-code-templates@latest --hook security/env-file-protectionWhat env-file-protection does
The hook listens on PreToolUse and matches the Write tool. When a path fits the .env* pattern, it returns a deny decision with the reason "Writing to .env files is blocked by hook". The write never happens.
Filtering runs through the if field set to Write(.env*). No process spawns until the pattern matches, so regular files pass through with no overhead. The command itself is a single echo that prints the JSON decision Claude expects.
Install with npx claude-code-templates@latest --hook security/env-file-protection; the entry lands in .claude/settings.json. The .env* pattern also covers .env.local and .env.production, so any env file the agent is supposed to edit gets blocked too. Worth checking your file list before you install.
What it helps with
- keep an agent from overwriting .env by mistake
- block writes to files holding secrets without a manual prompt
- stop Write calls to .env* before they run
- add a path guard to Claude settings without writing a script
Example prompts for the agent
- set up the hook so Write leaves .env alone
- why can't the agent write to .env.local?
- add a .env* write block to .claude/settings.json
How to install env-file-protection
1claude-code-templates
npx claude-code-templates@latest --hook security/env-file-protection2Manually: put the files in place
.claude/settings.jsonThe hooks block: event (PreToolUse, PostToolUse, Stop…) → command. Personal ones go to ~/.claude/settings.json
Step by step, with commands for each platform: Claude Code hooks: what they are, where to configure them, how to block a risky command
Questions about env-file-protection
How do I install env-file-protection in Claude?
Run npx claude-code-templates@latest --hook security/env-file-protection, then check .claude/settings.json — the hook config should be there.
What does env-file-protection do?
It blocks any Write tool call whose path matches .env*. Instead of writing, the hook returns a deny decision with an explanation.
When does the hook spawn a process?
Only when the Write(.env*) pattern matches. On other files the if filter keeps the command from running.
Source text
env-file-protection.json · MIT
{
"description": "Prevent writing to .env files using the if condition for lightweight filtering. Blocks any Write tool call targeting .env* files, protecting secrets from accidental overwrites. Uses the if field to avoid spawning a process unless the file pattern matches.",
"hooks": {
"PreToolUse": [
{
"matcher": "Write",
"hooks": [
{
"type": "command",
"if": "Write(.env*)",
"command": "echo '{\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"Writing to .env files is blocked by hook\"}}'"
}
]
}
]
}
}
© davila7 · MIT · davila7/claude-code-templates
