Why .gitignore Doesn't Keep Claude Out of Generated Code
Your repo commits generated code and a vendored SDK (neither is gitignored), and you don't want Claude Code reading either.
Since they're tracked in git, .gitignore doesn't help. What
actually blocks it?
The correct answer is "Explicit Read deny rules in permissions.deny."
Rules like Read(./**/dist/**) or Read(./vendor/**) block Claude's
file tools (and recognized Bash file commands) from reading those
paths regardless of git status. Adding "do not read" text to
CLAUDE.md is advisory, not enforced — Claude can still read the files
if a task seems to call for it; claudeMdExcludes only controls
whether CLAUDE.md/rules files load, not arbitrary file reads; and
tracked files absolutely can be denied — that's exactly what these
rules do.
Share this question