Your Claude Code Allow Rules May Have Holes: How to Audit settings.json After v2.1.214

v2.1.214 patched six permission bypasses — and the patterns that were exploitable are the same ones engineers commonly write in .claude/settings.json. Here's how to audit yours.

Claude Code's allow rules control what runs without approval. Most people write them once, test the happy path, and never revisit them. The six bypasses patched in v2.1.214 reveal what "looked safe, wasn't" actually looks like in production.

The biggest pattern to check: dir/** glob rules

Before (vulnerable): Edit(src/**) approved writes to any src/ directory anywhere in the tree. After the fix: Edit(src/**) only approves writes to <cwd>/src/.

Audit step: Open .claude/settings.json and scan every allow entry for ** patterns:

{
  "permissions": {
    "allow": [
      "Edit(src/**)",        // Was: any nested src/ anywhere in tree
      "Read(docs/**)",       // Was: any docs/ anywhere in tree
      "Bash(npm run:*)"      // Fine — prefix match, not glob
    ]
  }
}

If you have dir/** patterns, test them on the patched version: create deep/path/src/test.txt and confirm Claude prompts for approval instead of silently writing.

Tighten your rules

Write the narrowest rule that covers your use case:

// Instead of: "Edit(src/**)"       (tree-wide glob, was vulnerable)
// Use one of:
"Edit"                               // Any edit — if you trust all file edits
"Edit(src/components/**)"           // Lock to a specific subtree

Bash rules: Prefix-match rules (Bash(git:*)) are safer than pattern rules that could tunnel command substitutions. The fd-redirect and zsh subscript fixes in v2.1.214 show that the permission analyzer and bash can disagree on what a command does — prefer simple, unambiguous prefixes.

Full audit in 30 seconds

# Show all allow rules across project + global settings:
cat .claude/settings.json 2>/dev/null | python3 -m json.tool | grep -A50 '"allow"'
cat ~/.claude/settings.json 2>/dev/null | python3 -m json.tool | grep -A50 '"allow"'

If you're on Windows with PowerShell 5.1: The v2.1.214 fix for the PS 5.1 permission bypass is particularly important — update immediately via npm install -g @anthropic-ai/claude-code@latest.

After auditing: confirm your version with claude --version (should be ≥2.1.214).

Why it matters: Allow rules reduce friction, but rules written for convenience rather than precision create the exact bypasses v2.1.214 had to patch. The dir/** pattern alone likely affects most multi-module projects with a src/ directory at any level.

Sources: Claude Code Changelog v2.1.214, Claude Code Permissions Docs