[{"data":1,"prerenderedAt":1382},["ShallowReactive",2],{"article-\u002Farticles\u002Fclaude-code-deny-settei":3,"article-series-none":1381},{"_path":4,"_dir":5,"_draft":6,"_partial":6,"_locale":7,"title":8,"description":9,"date":10,"category":11,"author":12,"thumbnail":13,"tags":14,"faq":20,"body":33,"_type":1375,"_id":1376,"_source":1377,"_file":1378,"_stem":1379,"_extension":1380},"\u002Farticles\u002Fclaude-code-deny-settei","articles",false,"","Claude Codeの秘密情報対策｜読み取り禁止（deny）設定で防げること・防げないこと【実測】","Claude Code に .env や秘密鍵を読ませない読み取り禁止（permissions.deny）の設定と、6つの読み取り経路での実測結果をまとめました。cat は止まるが grep や環境変数経由は止まらないなど、設定で担保できる範囲を解説します。","2026-10-19","AI開発","K.S.ロジャース株式会社","\u002Fimg\u002Fcontents\u002Fnews\u002Fthumb134.jpg",[15,16,17,18,19],"Claude Code","AIコーディング","情報セキュリティ","AIガバナンス","開発",[21,24,27,30],{"q":22,"a":23},"Claude Code に .env ファイルを読ませない方法はありますか？","あります。プロジェクトの .claude\u002Fsettings.json の permissions.deny に \"Read(**\u002F.env)\" のようなルールを書きます。この設定をリポジトリにコミットすると、そのリポジトリで Claude Code を使う全員に同じ制限がかかります。ただし、ファイル名を指定しない検索やスクリプト経由の読み取りは止められないため、行動ルールと併用します。",{"q":25,"a":26},"permissions.deny を設定すれば、Bash の cat でも読めなくなりますか？","K.S.Rogers の検証（Claude Code v2.1.270）では、Read の deny に一致するファイルは、Bash の cat でも読み取りが拒否されました。allow に Bash(cat *) を書いた状態でも拒否され、deny が allow より優先されることを確認しています。一方、grep -rn での全体検索や、python3 で開いて出力する方法では値が表示されました。",{"q":28,"a":29},"個人の設定で deny を上書きできますか？","できません。ルールは deny、ask、allow の順に評価され、deny に一致した操作は、個人の設定（~\u002F.claude\u002Fsettings.json や .claude\u002Fsettings.local.json）に allow を書いても許可されません。",{"q":31,"a":32},"Cursor や GitHub Copilot にも同じような設定はありますか？","あります。Cursor は .cursorignore、Gemini CLI は .geminiignore、Codex は .codex\u002Fconfig.toml のファイルシステムの権限設定、GitHub Copilot は Content exclusion で読み取りを制限できます。ただし Cursor は公式にベストエフォートと明記しており、GitHub Copilot の Content exclusion は Copilot Business または Enterprise が必要です。",{"type":34,"children":35,"toc":1357},"root",[36,53,90,150,157,163,178,282,299,304,309,321,366,378,384,389,413,631,636,744,749,806,811,816,897,909,915,934,939,951,957,962,1129,1134,1139,1151,1191,1204,1209,1240,1251,1257,1270,1275],{"type":37,"tag":38,"props":39,"children":40},"element","p",{},[41,44,51],{"type":42,"value":43},"text","Claude Code のようなエージェント型の AI コーディングツールは、指示に応じて自分でリポジトリのファイルを開き、コマンドを実行します。便利な反面、「不具合の原因を調べて」と頼んだだけで、",{"type":37,"tag":45,"props":46,"children":48},"code",{"className":47},[],[49],{"type":42,"value":50},".env",{"type":42,"value":52}," や本番環境の設定ファイルに書かれたパスワードや API キーまで AI が読んでしまう、ということが起こりえます。",{"type":37,"tag":38,"props":54,"children":55},{},[56,58,72,74,79,81,88],{"type":42,"value":57},"これを防ぐ仕組みが、Claude Code の",{"type":37,"tag":59,"props":60,"children":61},"strong",{},[62,64,70],{"type":42,"value":63},"読み取り禁止（",{"type":37,"tag":45,"props":65,"children":67},{"className":66},[],[68],{"type":42,"value":69},"permissions.deny",{"type":42,"value":71},"）の設定",{"type":42,"value":73},"です。本記事では、この設定をリポジトリに置いてチーム全員に効かせる方法と、K.S.Rogers で実際に6つの読み取り経路を試した結果をもとに、",{"type":37,"tag":59,"props":75,"children":76},{},[77],{"type":42,"value":78},"設定で防げること・防げないこと",{"type":42,"value":80},"を整理します。外注先に AI 利用のルールを約束してもらう発注側の視点は、",{"type":37,"tag":82,"props":83,"children":85},"a",{"href":84},"\u002Farticles\u002Fkaihatsu-gaichu-ai-riyou-rule\u002F",[86],{"type":42,"value":87},"システム開発を外注するときのAI利用ルール",{"type":42,"value":89},"で扱っています。",{"type":37,"tag":91,"props":92,"children":93},"blockquote",{},[94,102],{"type":37,"tag":38,"props":95,"children":96},{},[97],{"type":37,"tag":59,"props":98,"children":99},{},[100],{"type":42,"value":101},"この記事の要点",{"type":37,"tag":103,"props":104,"children":105},"ul",{},[106,125,145],{"type":37,"tag":107,"props":108,"children":109},"li",{},[110,116,118,123],{"type":37,"tag":45,"props":111,"children":113},{"className":112},[],[114],{"type":42,"value":115},".claude\u002Fsettings.json",{"type":42,"value":117}," の ",{"type":37,"tag":45,"props":119,"children":121},{"className":120},[],[122],{"type":42,"value":69},{"type":42,"value":124}," に読み取り禁止のルールを書いてコミットすると、そのリポジトリで Claude Code を使う全員に同じ制限がかかります。deny は個人の allow で上書きできません",{"type":37,"tag":107,"props":126,"children":127},{},[128,130,136,138,143],{"type":42,"value":129},"実測では、Read ツールと ",{"type":37,"tag":45,"props":131,"children":133},{"className":132},[],[134],{"type":42,"value":135},"cat",{"type":42,"value":137}," などによる読み取りは止まりました。一方、",{"type":37,"tag":59,"props":139,"children":140},{},[141],{"type":42,"value":142},"ファイル名を指定しない検索、スクリプト経由の読み取り、環境変数に入れて使う経路",{"type":42,"value":144},"は止まりませんでした",{"type":37,"tag":107,"props":146,"children":147},{},[148],{"type":42,"value":149},"設定は「うっかり読まれる」を大きく減らしますが、万能ではありません。本番の認証情報を手元に置かない運用と、人の行動ルールを組み合わせます",{"type":37,"tag":151,"props":152,"children":154},"h2",{"id":153},"読み取り禁止denyの設定の基本",[155],{"type":42,"value":156},"読み取り禁止（deny）の設定の基本",{"type":37,"tag":158,"props":159,"children":161},"h3",{"id":160},"設定ファイルの置き場所",[162],{"type":42,"value":160},{"type":37,"tag":38,"props":164,"children":165},{},[166,168,176],{"type":42,"value":167},"Claude Code の設定ファイルは、置く場所によって誰に効くかが変わります（出典：",{"type":37,"tag":82,"props":169,"children":173},{"href":170,"rel":171},"https:\u002F\u002Fcode.claude.com\u002Fdocs\u002Fen\u002Fsettings",[172],"nofollow",[174],{"type":42,"value":175},"Claude Code Docs「Settings files and precedence」",{"type":42,"value":177},"）。",{"type":37,"tag":179,"props":180,"children":181},"table",{},[182,206],{"type":37,"tag":183,"props":184,"children":185},"thead",{},[186],{"type":37,"tag":187,"props":188,"children":189},"tr",{},[190,196,201],{"type":37,"tag":191,"props":192,"children":193},"th",{},[194],{"type":42,"value":195},"ファイル",{"type":37,"tag":191,"props":197,"children":198},{},[199],{"type":42,"value":200},"効く範囲",{"type":37,"tag":191,"props":202,"children":203},{},[204],{"type":42,"value":205},"Git",{"type":37,"tag":207,"props":208,"children":209},"tbody",{},[210,237,260],{"type":37,"tag":187,"props":211,"children":212},{},[213,224,229],{"type":37,"tag":214,"props":215,"children":216},"td",{},[217,222],{"type":37,"tag":45,"props":218,"children":220},{"className":219},[],[221],{"type":42,"value":115},{"type":42,"value":223},"（リポジトリ直下）",{"type":37,"tag":214,"props":225,"children":226},{},[227],{"type":42,"value":228},"そのリポジトリを使う全員",{"type":37,"tag":214,"props":230,"children":231},{},[232],{"type":37,"tag":59,"props":233,"children":234},{},[235],{"type":42,"value":236},"コミットする",{"type":37,"tag":187,"props":238,"children":239},{},[240,250,255],{"type":37,"tag":214,"props":241,"children":242},{},[243,249],{"type":37,"tag":45,"props":244,"children":246},{"className":245},[],[247],{"type":42,"value":248},".claude\u002Fsettings.local.json",{"type":42,"value":223},{"type":37,"tag":214,"props":251,"children":252},{},[253],{"type":42,"value":254},"自分だけ、そのリポジトリだけ",{"type":37,"tag":214,"props":256,"children":257},{},[258],{"type":42,"value":259},"コミットしない（.gitignore に入れる）",{"type":37,"tag":187,"props":261,"children":262},{},[263,272,277],{"type":37,"tag":214,"props":264,"children":265},{},[266],{"type":37,"tag":45,"props":267,"children":269},{"className":268},[],[270],{"type":42,"value":271},"~\u002F.claude\u002Fsettings.json",{"type":37,"tag":214,"props":273,"children":274},{},[275],{"type":42,"value":276},"自分だけ、すべてのプロジェクト",{"type":37,"tag":214,"props":278,"children":279},{},[280],{"type":42,"value":281},"—",{"type":37,"tag":38,"props":283,"children":284},{},[285,287,297],{"type":42,"value":286},"読み取り禁止のルールは、",{"type":37,"tag":59,"props":288,"children":289},{},[290,295],{"type":37,"tag":45,"props":291,"children":293},{"className":292},[],[294],{"type":42,"value":115},{"type":42,"value":296}," に書いてコミット",{"type":42,"value":298},"します。リポジトリを取得した人全員に、同じ制限が自動でかかります。メンバー1人1人に設定を頼む必要がなく、設定の変更も PR レビューを通して記録に残せます。",{"type":37,"tag":158,"props":300,"children":302},{"id":301},"設定のサンプル",[303],{"type":42,"value":301},{"type":37,"tag":38,"props":305,"children":306},{},[307],{"type":42,"value":308},"多くのリポジトリで共通して使える、読み取り禁止の例です。",{"type":37,"tag":310,"props":311,"children":316},"pre",{"className":312,"code":314,"language":315,"meta":7},[313],"language-json","{\n  \"permissions\": {\n    \"deny\": [\n      \"Read(**\u002F.env)\",\n      \"Read(**\u002F.envrc)\",\n      \"Read(**\u002F*.pem)\",\n      \"Read(**\u002F*.key)\",\n      \"Read(**\u002F*.p12)\",\n      \"Read(**\u002F*.pfx)\",\n      \"Read(**\u002Fid_rsa)\",\n      \"Read(**\u002Fid_ed25519)\",\n      \"Read(**\u002F*credentials*.json)\",\n      \"Read(**\u002Fservice-account*.json)\",\n      \"Read(**\u002F.htpasswd)\",\n      \"Read(**\u002F*.tfvars)\",\n      \"Read(**\u002F*.tfstate)\",\n      \"Read(**\u002F*.tfstate.backup)\",\n      \"Read(~\u002F.ssh\u002F**)\",\n      \"Read(~\u002F.aws\u002F**)\",\n      \"Read(~\u002F.config\u002Fgcloud\u002F**)\"\n    ]\n  }\n}\n","json",[317],{"type":37,"tag":45,"props":318,"children":319},{"__ignoreMap":7},[320],{"type":42,"value":314},{"type":37,"tag":38,"props":322,"children":323},{},[324,326,332,334,340,342,348,350,356,358,364],{"type":42,"value":325},"このうえで、プロジェクトごとの本番・ステージングの設定ファイル（",{"type":37,"tag":45,"props":327,"children":329},{"className":328},[],[330],{"type":42,"value":331},"config\u002F",{"type":42,"value":333}," 配下の環境別の設定、",{"type":37,"tag":45,"props":335,"children":337},{"className":336},[],[338],{"type":42,"value":339},"database.yml",{"type":42,"value":341}," など）を追加します。まだ存在しないファイルの種類（",{"type":37,"tag":45,"props":343,"children":345},{"className":344},[],[346],{"type":42,"value":347},"*.pem",{"type":42,"value":349}," など）も、将来の混入に備えて先に入れておくと安心です。ホームディレクトリの ",{"type":37,"tag":45,"props":351,"children":353},{"className":352},[],[354],{"type":42,"value":355},"~\u002F.ssh",{"type":42,"value":357}," や ",{"type":37,"tag":45,"props":359,"children":361},{"className":360},[],[362],{"type":42,"value":363},"~\u002F.aws",{"type":42,"value":365}," はリポジトリの外ですが、AI から読める場所なので対象に含めます。",{"type":37,"tag":38,"props":367,"children":368},{},[369,371,376],{"type":42,"value":370},"判断の基準は、",{"type":37,"tag":59,"props":372,"children":373},{},[374],{"type":42,"value":375},"ファイルの種類ではなく、書かれている値",{"type":42,"value":377},"です。同じ設定ファイルでも、テンプレートやダミーの値しか入っていないものは対象外にし、本番の値が入るものを対象にします。",{"type":37,"tag":151,"props":379,"children":381},{"id":380},"実測6つの読み取り経路で何が止まったか",[382],{"type":42,"value":383},"実測：6つの読み取り経路で何が止まったか",{"type":37,"tag":38,"props":385,"children":386},{},[387],{"type":42,"value":388},"K.S.Rogers で、Claude Code v2.1.270 を使って検証しました（2026年9月）。秘密の値を入れたファイルを deny の対象にしたうえで、確認のダイアログの影響を除くため、試すコマンドはあえて allow に入れた状態で、6つの経路を試しています。",{"type":37,"tag":390,"props":391,"children":392},"picture",{},[393,395,403,404],{"type":42,"value":394},"\n  ",{"type":37,"tag":396,"props":397,"children":402},"source",{"media":398,"srcSet":399,"width":400,"height":401},"(max-width: 768px)","\u002Fimg\u002Fcontents\u002Farticles\u002Fclaude-code-deny-settei\u002Fjissoku-6-sp.svg",420,640,[],{"type":42,"value":394},{"type":37,"tag":405,"props":406,"children":412},"img",{"src":407,"alt":408,"width":409,"height":410,"loading":411},"\u002Fimg\u002Fcontents\u002Farticles\u002Fclaude-code-deny-settei\u002Fjissoku-6.svg","Claude Codeのdeny設定の実測結果：Readツールとcatはブロック、deny対象外のファイルは通常どおり読める。一方、grepでの全体検索、Pythonスクリプトでの読み取り、環境変数に入れて使う経路は止まらなかった",800,400,"lazy",[],{"type":37,"tag":179,"props":414,"children":415},{},[416,442],{"type":37,"tag":183,"props":417,"children":418},{},[419],{"type":37,"tag":187,"props":420,"children":421},{},[422,427,432,437],{"type":37,"tag":191,"props":423,"children":424},{},[425],{"type":42,"value":426},"#",{"type":37,"tag":191,"props":428,"children":429},{},[430],{"type":42,"value":431},"経路",{"type":37,"tag":191,"props":433,"children":434},{},[435],{"type":42,"value":436},"結果",{"type":37,"tag":191,"props":438,"children":439},{},[440],{"type":42,"value":441},"分かったこと",{"type":37,"tag":207,"props":443,"children":444},{},[445,471,510,543,574,608],{"type":37,"tag":187,"props":446,"children":447},{},[448,453,458,466],{"type":37,"tag":214,"props":449,"children":450},{},[451],{"type":42,"value":452},"1",{"type":37,"tag":214,"props":454,"children":455},{},[456],{"type":42,"value":457},"Read ツールでファイルを開く",{"type":37,"tag":214,"props":459,"children":460},{},[461],{"type":37,"tag":59,"props":462,"children":463},{},[464],{"type":42,"value":465},"ブロック",{"type":37,"tag":214,"props":467,"children":468},{},[469],{"type":42,"value":470},"拒否のメッセージが返り、中身は AI に届かない",{"type":37,"tag":187,"props":472,"children":473},{},[474,479,490,497],{"type":37,"tag":214,"props":475,"children":476},{},[477],{"type":42,"value":478},"2",{"type":37,"tag":214,"props":480,"children":481},{},[482,484],{"type":42,"value":483},"Bash で ",{"type":37,"tag":45,"props":485,"children":487},{"className":486},[],[488],{"type":42,"value":489},"cat \u003Cファイル>",{"type":37,"tag":214,"props":491,"children":492},{},[493],{"type":37,"tag":59,"props":494,"children":495},{},[496],{"type":42,"value":465},{"type":37,"tag":214,"props":498,"children":499},{},[500,502,508],{"type":42,"value":501},"allow に ",{"type":37,"tag":45,"props":503,"children":505},{"className":504},[],[506],{"type":42,"value":507},"Bash(cat *)",{"type":42,"value":509}," を書いた状態でも拒否された。deny は allow より優先される",{"type":37,"tag":187,"props":511,"children":512},{},[513,518,528,538],{"type":37,"tag":214,"props":514,"children":515},{},[516],{"type":42,"value":517},"3",{"type":37,"tag":214,"props":519,"children":520},{},[521,522],{"type":42,"value":483},{"type":37,"tag":45,"props":523,"children":525},{"className":524},[],[526],{"type":42,"value":527},"grep -rn PASSWORD .",{"type":37,"tag":214,"props":529,"children":530},{},[531,536],{"type":37,"tag":59,"props":532,"children":533},{},[534],{"type":42,"value":535},"止まらない",{"type":42,"value":537},"（値が表示された）",{"type":37,"tag":214,"props":539,"children":540},{},[541],{"type":42,"value":542},"ファイル名を指定せずに全体を検索する経路は、deny の対象外",{"type":37,"tag":187,"props":544,"children":545},{},[546,551,561,569],{"type":37,"tag":214,"props":547,"children":548},{},[549],{"type":42,"value":550},"4",{"type":37,"tag":214,"props":552,"children":553},{},[554,555],{"type":42,"value":483},{"type":37,"tag":45,"props":556,"children":558},{"className":557},[],[559],{"type":42,"value":560},"python3 -c \"print(open('\u003Cファイル>').read())\"",{"type":37,"tag":214,"props":562,"children":563},{},[564,568],{"type":37,"tag":59,"props":565,"children":566},{},[567],{"type":42,"value":535},{"type":42,"value":537},{"type":37,"tag":214,"props":570,"children":571},{},[572],{"type":42,"value":573},"Claude Code が「ファイルを読むコマンド」と認識しない経路は、deny の対象外",{"type":37,"tag":187,"props":575,"children":576},{},[577,582,594,603],{"type":37,"tag":214,"props":578,"children":579},{},[580],{"type":42,"value":581},"5",{"type":37,"tag":214,"props":583,"children":584},{},[585,586,592],{"type":42,"value":483},{"type":37,"tag":45,"props":587,"children":589},{"className":588},[],[590],{"type":42,"value":591},"source \u003Cファイル>",{"type":42,"value":593}," して環境変数を使う",{"type":37,"tag":214,"props":595,"children":596},{},[597,601],{"type":37,"tag":59,"props":598,"children":599},{},[600],{"type":42,"value":535},{"type":42,"value":602},"（値を表示しないまま使えた）",{"type":37,"tag":214,"props":604,"children":605},{},[606],{"type":42,"value":607},"値を画面に出さずに、環境変数として使う経路は止められない",{"type":37,"tag":187,"props":609,"children":610},{},[611,616,621,626],{"type":37,"tag":214,"props":612,"children":613},{},[614],{"type":42,"value":615},"6",{"type":37,"tag":214,"props":617,"children":618},{},[619],{"type":42,"value":620},"deny の対象外のファイルを読む",{"type":37,"tag":214,"props":622,"children":623},{},[624],{"type":42,"value":625},"通常どおり読める",{"type":37,"tag":214,"props":627,"children":628},{},[629],{"type":42,"value":630},"関係ないファイルまで止める、ということは起きなかった",{"type":37,"tag":158,"props":632,"children":634},{"id":633},"設定で担保できること",[635],{"type":42,"value":633},{"type":37,"tag":103,"props":637,"children":638},{},[639,694,704,714,724,734],{"type":37,"tag":107,"props":640,"children":641},{},[642,692],{"type":37,"tag":59,"props":643,"children":644},{},[645,647,652,654,660,661,667,668,674,676,682,684,690],{"type":42,"value":646},"Read の deny は、Bash の ",{"type":37,"tag":45,"props":648,"children":650},{"className":649},[],[651],{"type":42,"value":135},{"type":42,"value":653},"・",{"type":37,"tag":45,"props":655,"children":657},{"className":656},[],[658],{"type":42,"value":659},"head",{"type":42,"value":653},{"type":37,"tag":45,"props":662,"children":664},{"className":663},[],[665],{"type":42,"value":666},"tail",{"type":42,"value":653},{"type":37,"tag":45,"props":669,"children":671},{"className":670},[],[672],{"type":42,"value":673},"sed",{"type":42,"value":675}," や、リダイレクト（",{"type":37,"tag":45,"props":677,"children":679},{"className":678},[],[680],{"type":42,"value":681},"> ファイル",{"type":42,"value":683}," ",{"type":37,"tag":45,"props":685,"children":687},{"className":686},[],[688],{"type":42,"value":689},"\u003C ファイル",{"type":42,"value":691},"）にも効きます",{"type":42,"value":693},"（上の表の1・2）。ファイルを開く代表的な方法は、1つのルールでまとめて止められます",{"type":37,"tag":107,"props":695,"children":696},{},[697,702],{"type":37,"tag":59,"props":698,"children":699},{},[700],{"type":42,"value":701},"deny は allow より優先されます",{"type":42,"value":703},"。ルールは deny → ask → allow の順に評価されるため、メンバーが個人の設定に allow を書いても上書きできません（上の表の2）",{"type":37,"tag":107,"props":705,"children":706},{},[707,712],{"type":37,"tag":59,"props":708,"children":709},{},[710],{"type":42,"value":711},"ブロックするときは確認のダイアログが出ません",{"type":42,"value":713},"。「ダイアログが出たが、よく読まずに許可してしまった」という経路がなくなります",{"type":37,"tag":107,"props":715,"children":716},{},[717,722],{"type":37,"tag":59,"props":718,"children":719},{},[720],{"type":42,"value":721},"deny はリポジトリを信頼（trust）する前から効きます",{"type":42,"value":723},"。リポジトリを取得した直後から有効です",{"type":37,"tag":107,"props":725,"children":726},{},[727,732],{"type":37,"tag":59,"props":728,"children":729},{},[730],{"type":42,"value":731},"Read の deny は、同じファイルへの Edit・Write も止めます",{"type":42,"value":733},"。AI が秘密ファイルを書き換えたり、新しく作ったりすることも防げます",{"type":37,"tag":107,"props":735,"children":736},{},[737,742],{"type":37,"tag":59,"props":738,"children":739},{},[740],{"type":42,"value":741},"シンボリックリンク経由の読み取りも止まります",{"type":42,"value":743},"。リンクそのものとリンク先のどちらかが deny に一致すれば遮断されます",{"type":37,"tag":158,"props":745,"children":747},{"id":746},"設定で担保できないこと",[748],{"type":42,"value":746},{"type":37,"tag":103,"props":750,"children":751},{},[752,770,780,798],{"type":37,"tag":107,"props":753,"children":754},{},[755,760,762,768],{"type":37,"tag":59,"props":756,"children":757},{},[758],{"type":42,"value":759},"ファイル名を指定しない読み取り",{"type":42,"value":761},"（表の3）。",{"type":37,"tag":45,"props":763,"children":765},{"className":764},[],[766],{"type":42,"value":767},"grep -r \"password\" .",{"type":42,"value":769}," のような全体検索では、中身が出力されます",{"type":37,"tag":107,"props":771,"children":772},{},[773,778],{"type":37,"tag":59,"props":774,"children":775},{},[776],{"type":42,"value":777},"AI が書いたスクリプトなど、読み取りと認識されないコマンド",{"type":42,"value":779},"（表の4）。Python や Node.js のスクリプトからファイルを開くと、中身が出力されます",{"type":37,"tag":107,"props":781,"children":782},{},[783,788,790,796],{"type":37,"tag":59,"props":784,"children":785},{},[786],{"type":42,"value":787},"値を「見ずに使う」こと",{"type":42,"value":789},"（表の5）。",{"type":37,"tag":45,"props":791,"children":793},{"className":792},[],[794],{"type":42,"value":795},"source .env",{"type":42,"value":797}," で環境変数に入れてから DB や API に接続する、設定ファイルを指定して DB クライアントを起動する、といった方法では、AI は値を一度も表示しないまま認証情報を使えます",{"type":37,"tag":107,"props":799,"children":800},{},[801],{"type":37,"tag":59,"props":802,"children":803},{},[804],{"type":42,"value":805},"人がファイルを開いてコピーし、チャットに貼り付けること",{"type":37,"tag":151,"props":807,"children":809},{"id":808},"バージョンによる違い",[810],{"type":42,"value":808},{"type":37,"tag":38,"props":812,"children":813},{},[814],{"type":42,"value":815},"上の挙動は、Claude Code のバージョンによって違います。K.S.Rogers の確認では、次のバージョンから動作が変わっていました。",{"type":37,"tag":179,"props":817,"children":818},{},[819,835],{"type":37,"tag":183,"props":820,"children":821},{},[822],{"type":37,"tag":187,"props":823,"children":824},{},[825,830],{"type":37,"tag":191,"props":826,"children":827},{},[828],{"type":42,"value":829},"挙動",{"type":37,"tag":191,"props":831,"children":832},{},[833],{"type":42,"value":834},"必要なバージョン",{"type":37,"tag":207,"props":836,"children":837},{},[838,851,864,884],{"type":37,"tag":187,"props":839,"children":840},{},[841,846],{"type":37,"tag":214,"props":842,"children":843},{},[844],{"type":42,"value":845},"Read の deny が Edit も止める",{"type":37,"tag":214,"props":847,"children":848},{},[849],{"type":42,"value":850},"v2.1.208 以上",{"type":37,"tag":187,"props":852,"children":853},{},[854,859],{"type":37,"tag":214,"props":855,"children":856},{},[857],{"type":42,"value":858},"Read の deny が Write も止める",{"type":37,"tag":214,"props":860,"children":861},{},[862],{"type":42,"value":863},"v2.1.228 以上",{"type":37,"tag":187,"props":865,"children":866},{},[867,879],{"type":37,"tag":214,"props":868,"children":869},{},[870,872,877],{"type":42,"value":871},"入力リダイレクト（",{"type":37,"tag":45,"props":873,"children":875},{"className":874},[],[876],{"type":42,"value":689},{"type":42,"value":878},"）も検査する",{"type":37,"tag":214,"props":880,"children":881},{},[882],{"type":42,"value":883},"v2.1.257 以上",{"type":37,"tag":187,"props":885,"children":886},{},[887,892],{"type":37,"tag":214,"props":888,"children":889},{},[890],{"type":42,"value":891},"シンボリックリンク経由でディレクトリを指定した deny が効く",{"type":37,"tag":214,"props":893,"children":894},{},[895],{"type":42,"value":896},"v2.1.268 以上",{"type":37,"tag":38,"props":898,"children":899},{},[900,902,907],{"type":42,"value":901},"チームで運用するなら、",{"type":37,"tag":59,"props":903,"children":904},{},[905],{"type":42,"value":906},"必須は v2.1.208 以上、推奨は v2.1.268 以上",{"type":42,"value":908},"のように下限を決め、メンバーの参画時と定期の棚卸しのときにバージョンを確認します。",{"type":37,"tag":151,"props":910,"children":912},{"id":911},"落とし穴親のディレクトリで起動すると子の設定は読まれない",[913],{"type":42,"value":914},"落とし穴：親のディレクトリで起動すると、子の設定は読まれない",{"type":37,"tag":38,"props":916,"children":917},{},[918,920,925,927,932],{"type":42,"value":919},"見落としやすいのが、",{"type":37,"tag":59,"props":921,"children":922},{},[923],{"type":42,"value":924},"どのディレクトリで Claude Code を起動したか",{"type":42,"value":926},"です。プロジェクトの設定（",{"type":37,"tag":45,"props":928,"children":930},{"className":929},[],[931],{"type":42,"value":115},{"type":42,"value":933},"）は、セッションを起動したディレクトリのものが読まれます（出典：前掲「Settings files and precedence」）。",{"type":37,"tag":38,"props":935,"children":936},{},[937],{"type":42,"value":938},"たとえば、Docker Compose などで1つの親ディレクトリの下に複数のリポジトリを並べて開発している場合、親ディレクトリで Claude Code を起動すると、読まれるのは親の設定だけで、各リポジトリに置いた設定は読まれません。いちばんよく使う起動方法で、設定が効いていない、ということが起こります。",{"type":37,"tag":38,"props":940,"children":941},{},[942,944,949],{"type":42,"value":943},"この場合は、",{"type":37,"tag":59,"props":945,"children":946},{},[947],{"type":42,"value":948},"親ディレクトリの設定に、配下のすべてのリポジトリ分の deny をまとめて入れておきます",{"type":42,"value":950},"。",{"type":37,"tag":151,"props":952,"children":954},{"id":953},"ほかのaiツールの読み取り制限",[955],{"type":42,"value":956},"ほかのAIツールの読み取り制限",{"type":37,"tag":38,"props":958,"children":959},{},[960],{"type":42,"value":961},"Claude Code 以外のツールにも、リポジトリ側で読み取りを制限する仕組みがあります（2026年9月時点）。",{"type":37,"tag":179,"props":963,"children":964},{},[965,986],{"type":37,"tag":183,"props":966,"children":967},{},[968],{"type":37,"tag":187,"props":969,"children":970},{},[971,976,981],{"type":37,"tag":191,"props":972,"children":973},{},[974],{"type":42,"value":975},"ツール",{"type":37,"tag":191,"props":977,"children":978},{},[979],{"type":42,"value":980},"仕組み",{"type":37,"tag":191,"props":982,"children":983},{},[984],{"type":42,"value":985},"注意点",{"type":37,"tag":207,"props":987,"children":988},{},[989,1024,1056,1080,1111],{"type":37,"tag":187,"props":990,"children":991},{},[992,997,1010],{"type":37,"tag":214,"props":993,"children":994},{},[995],{"type":42,"value":996},"Cursor",{"type":37,"tag":214,"props":998,"children":999},{},[1000,1002,1008],{"type":42,"value":1001},"リポジトリ直下の ",{"type":37,"tag":45,"props":1003,"children":1005},{"className":1004},[],[1006],{"type":42,"value":1007},".cursorignore",{"type":42,"value":1009},"（.gitignore と同じ書き方）",{"type":37,"tag":214,"props":1011,"children":1012},{},[1013,1015,1022],{"type":42,"value":1014},"公式に「ベストエフォートで、ブロックを保証しない」と明記。エージェントのターミナルや MCP のツールからの読み取りは止められない（出典：",{"type":37,"tag":82,"props":1016,"children":1019},{"href":1017,"rel":1018},"https:\u002F\u002Fcursor.com\u002Fdocs\u002Freference\u002Fignore-file",[172],[1020],{"type":42,"value":1021},"Cursor Docs「Ignore File」",{"type":42,"value":1023},"）",{"type":37,"tag":187,"props":1025,"children":1026},{},[1027,1032,1051],{"type":37,"tag":214,"props":1028,"children":1029},{},[1030],{"type":42,"value":1031},"Gemini",{"type":37,"tag":214,"props":1033,"children":1034},{},[1035,1037,1043,1045],{"type":42,"value":1036},"Gemini CLI は ",{"type":37,"tag":45,"props":1038,"children":1040},{"className":1039},[],[1041],{"type":42,"value":1042},".geminiignore",{"type":42,"value":1044},"、Gemini Code Assist は ",{"type":37,"tag":45,"props":1046,"children":1048},{"className":1047},[],[1049],{"type":42,"value":1050},".aiexclude",{"type":37,"tag":214,"props":1052,"children":1053},{},[1054],{"type":42,"value":1055},"Web やアプリで使う場合は対象外",{"type":37,"tag":187,"props":1057,"children":1058},{},[1059,1064,1075],{"type":37,"tag":214,"props":1060,"children":1061},{},[1062],{"type":42,"value":1063},"ChatGPT（Codex）",{"type":37,"tag":214,"props":1065,"children":1066},{},[1067,1073],{"type":37,"tag":45,"props":1068,"children":1070},{"className":1069},[],[1071],{"type":42,"value":1072},".codex\u002Fconfig.toml",{"type":42,"value":1074}," のファイルシステムの権限設定で、対象を deny にする",{"type":37,"tag":214,"props":1076,"children":1077},{},[1078],{"type":42,"value":1079},"プロジェクトの設定は、そのプロジェクトを信頼（trust）したときだけ読み込まれる。初回に信頼する手順を案内する",{"type":37,"tag":187,"props":1081,"children":1082},{},[1083,1088,1093],{"type":37,"tag":214,"props":1084,"children":1085},{},[1086],{"type":42,"value":1087},"GitHub Copilot",{"type":37,"tag":214,"props":1089,"children":1090},{},[1091],{"type":42,"value":1092},"Content exclusion（リポジトリ・Organization の設定）",{"type":37,"tag":214,"props":1094,"children":1095},{},[1096,1101,1103,1110],{"type":37,"tag":59,"props":1097,"children":1098},{},[1099],{"type":42,"value":1100},"Copilot Business または Enterprise が必要",{"type":42,"value":1102},"。個人向けのプランでは使えない（出典：",{"type":37,"tag":82,"props":1104,"children":1107},{"href":1105,"rel":1106},"https:\u002F\u002Fdocs.github.com\u002Fen\u002Fcopilot\u002Fconcepts\u002Fcontext\u002Fcontent-exclusion",[172],[1108],{"type":42,"value":1109},"GitHub Docs「Content exclusion for GitHub Copilot」",{"type":42,"value":1023},{"type":37,"tag":187,"props":1112,"children":1113},{},[1114,1119,1124],{"type":37,"tag":214,"props":1115,"children":1116},{},[1117],{"type":42,"value":1118},"ChatGPT・Claude・Gemini の Web やアプリ、Microsoft 365 Copilot",{"type":37,"tag":214,"props":1120,"children":1121},{},[1122],{"type":42,"value":1123},"—（ファイルを自分で読まない）",{"type":37,"tag":214,"props":1125,"children":1126},{},[1127],{"type":42,"value":1128},"人が貼り付ける使い方なので、行動ルールで対応する。デスクトップアプリで MCP などのローカル連携を有効にしている場合は、エージェント型として扱う",{"type":37,"tag":38,"props":1130,"children":1131},{},[1132],{"type":42,"value":1133},"どのツールも、Claude Code と同じ対象ファイルを指定しておくと、管理が楽になります。GitHub Copilot をチームで使うなら、読み取りを制限できない個人向けのプランは使わない、と決めておくのが安全です。",{"type":37,"tag":151,"props":1135,"children":1137},{"id":1136},"設定で防げない経路への対策",[1138],{"type":42,"value":1136},{"type":37,"tag":38,"props":1140,"children":1141},{},[1142,1144,1149],{"type":42,"value":1143},"設定の限界を踏まえると、最も確実なのは、",{"type":37,"tag":59,"props":1145,"children":1146},{},[1147],{"type":42,"value":1148},"AI が読める場所に本番の認証情報を置かない",{"type":42,"value":1150},"ことです。",{"type":37,"tag":103,"props":1152,"children":1153},{},[1154,1171,1181],{"type":37,"tag":107,"props":1155,"children":1156},{},[1157,1162,1164,1169],{"type":37,"tag":59,"props":1158,"children":1159},{},[1160],{"type":42,"value":1161},"手元の開発環境では、ダミーや開発用の値だけを使う",{"type":42,"value":1163}," ―― 本番やステージングの認証情報は、開発者の PC の ",{"type":37,"tag":45,"props":1165,"children":1167},{"className":1166},[],[1168],{"type":42,"value":50},{"type":42,"value":1170}," に置かない",{"type":37,"tag":107,"props":1172,"children":1173},{},[1174,1179],{"type":37,"tag":59,"props":1175,"children":1176},{},[1177],{"type":42,"value":1178},"認証情報はシークレット管理のサービスに置く",{"type":42,"value":1180}," ―― クラウドのシークレット管理機能などを使い、必要なときに必要な権限の人だけが取り出す形にする",{"type":37,"tag":107,"props":1182,"children":1183},{},[1184,1189],{"type":37,"tag":59,"props":1185,"children":1186},{},[1187],{"type":42,"value":1188},"漏れても影響が小さい権限にする",{"type":42,"value":1190}," ―― 開発用のキーは権限を絞り、定期的に作り直す",{"type":37,"tag":38,"props":1192,"children":1193},{},[1194,1196,1202],{"type":42,"value":1195},"deny をすり抜ける経路（全体検索・スクリプト経由・環境変数経由）を実行前に検出して人の確認を求める hooks の設定は、続編の",{"type":37,"tag":82,"props":1197,"children":1199},{"href":1198},"\u002Farticles\u002Fclaude-code-hooks-guardrails\u002F",[1200],{"type":42,"value":1201},"Claude Codeに秘密情報を扱わせないhooksの設定例",{"type":42,"value":1203},"で解説しています。設定一式は GitHub で公開しています。",{"type":37,"tag":38,"props":1205,"children":1206},{},[1207],{"type":42,"value":1208},"そのうえで、人の行動ルールを決めます。",{"type":37,"tag":103,"props":1210,"children":1211},{},[1212,1217,1222,1235],{"type":37,"tag":107,"props":1213,"children":1214},{},[1215],{"type":42,"value":1216},"認証情報を、AI のプロンプトやチャットに貼り付けない",{"type":37,"tag":107,"props":1218,"children":1219},{},[1220],{"type":42,"value":1221},"本番の設定ファイルの中身を、AI に読み上げさせたり要約させたりしない",{"type":37,"tag":107,"props":1223,"children":1224},{},[1225,1227,1233],{"type":42,"value":1226},"AI が ",{"type":37,"tag":45,"props":1228,"children":1230},{"className":1229},[],[1231],{"type":42,"value":1232},"grep",{"type":42,"value":1234}," での全体検索や、スクリプトでのファイル読み取りをしようとしたら、対象を確認してから許可する",{"type":37,"tag":107,"props":1236,"children":1237},{},[1238],{"type":42,"value":1239},"誤って読ませてしまったときは、すぐに報告し、該当する認証情報を無効にして作り直す",{"type":37,"tag":38,"props":1241,"children":1242},{},[1243,1245,1249],{"type":42,"value":1244},"チームとして約束すべきルールの全体像（使ってよいツール、秘密情報の区分、レビュー、棚卸し、事故のときの対応）は、",{"type":37,"tag":82,"props":1246,"children":1247},{"href":84},[1248],{"type":42,"value":87},{"type":42,"value":1250},"にまとめています。",{"type":37,"tag":151,"props":1252,"children":1254},{"id":1253},"ksrogers-の支援",[1255],{"type":42,"value":1256},"K.S.Rogers の支援",{"type":37,"tag":38,"props":1258,"children":1259},{},[1260,1262,1268],{"type":42,"value":1261},"K.S.Rogers では、自社の開発で AI コーディングツールの利用ルールと、リポジトリ側の読み取り禁止の設定を運用しています。開発チームへの AI ツールの導入、利用ルールと設定のひな形づくり、既存のリポジトリの秘密情報の棚卸しなどのご相談は、",{"type":37,"tag":82,"props":1263,"children":1265},{"href":1264},"\u002Fcontact\u002F",[1266],{"type":42,"value":1267},"お問い合わせ",{"type":42,"value":1269},"からどうぞ。",{"type":37,"tag":151,"props":1271,"children":1273},{"id":1272},"まとめ",[1274],{"type":42,"value":1272},{"type":37,"tag":103,"props":1276,"children":1277},{},[1278,1303,1329,1341,1346],{"type":37,"tag":107,"props":1279,"children":1280},{},[1281,1283,1288,1289,1294,1296,1301],{"type":42,"value":1282},"Claude Code の読み取り禁止は、",{"type":37,"tag":45,"props":1284,"children":1286},{"className":1285},[],[1287],{"type":42,"value":115},{"type":42,"value":117},{"type":37,"tag":45,"props":1290,"children":1292},{"className":1291},[],[1293],{"type":42,"value":69},{"type":42,"value":1295}," に書いて",{"type":37,"tag":59,"props":1297,"children":1298},{},[1299],{"type":42,"value":1300},"コミット",{"type":42,"value":1302},"します。全員に同じ制限がかかり、個人の allow では上書きできません",{"type":37,"tag":107,"props":1304,"children":1305},{},[1306,1308,1320,1322,1327],{"type":42,"value":1307},"実測では、",{"type":37,"tag":59,"props":1309,"children":1310},{},[1311,1313,1318],{"type":42,"value":1312},"Read ツールと ",{"type":37,"tag":45,"props":1314,"children":1316},{"className":1315},[],[1317],{"type":42,"value":135},{"type":42,"value":1319}," などは止まり",{"type":42,"value":1321},"、",{"type":37,"tag":59,"props":1323,"children":1324},{},[1325],{"type":42,"value":1326},"ファイル名を指定しない検索、スクリプト経由、環境変数に入れて使う経路は止まりません",{"type":42,"value":1328},"でした",{"type":37,"tag":107,"props":1330,"children":1331},{},[1332,1334,1339],{"type":42,"value":1333},"バージョンによって効く範囲が違うため、下限を決めて確認します。",{"type":37,"tag":59,"props":1335,"children":1336},{},[1337],{"type":42,"value":1338},"親のディレクトリで起動すると、子の設定は読まれない",{"type":42,"value":1340},"点にも注意します",{"type":37,"tag":107,"props":1342,"children":1343},{},[1344],{"type":42,"value":1345},"Cursor・Gemini・Codex・GitHub Copilot にも読み取りを制限する仕組みがありますが、それぞれ条件や限界があります",{"type":37,"tag":107,"props":1347,"children":1348},{},[1349,1351,1355],{"type":42,"value":1350},"最も確実なのは、",{"type":37,"tag":59,"props":1352,"children":1353},{},[1354],{"type":42,"value":1148},{"type":42,"value":1356},"ことです。設定と行動ルールを組み合わせて運用します",{"title":7,"searchDepth":1358,"depth":1358,"links":1359},2,[1360,1365,1369,1370,1371,1372,1373,1374],{"id":153,"depth":1358,"text":156,"children":1361},[1362,1364],{"id":160,"depth":1363,"text":160},3,{"id":301,"depth":1363,"text":301},{"id":380,"depth":1358,"text":383,"children":1366},[1367,1368],{"id":633,"depth":1363,"text":633},{"id":746,"depth":1363,"text":746},{"id":808,"depth":1358,"text":808},{"id":911,"depth":1358,"text":914},{"id":953,"depth":1358,"text":956},{"id":1136,"depth":1358,"text":1136},{"id":1253,"depth":1358,"text":1256},{"id":1272,"depth":1358,"text":1272},"markdown","content:articles:claude-code-deny-settei.md","content","articles\u002Fclaude-code-deny-settei.md","articles\u002Fclaude-code-deny-settei","md",[],1792342258883]