Your Claude Code Deny List Is Leaky

After a short stint of letting Claude handle adding, committing, and pushing changes to a project, I realized I didn't like it. It was too eager to make changes that were too aggressive and too broadly scoped, and everything felt noisy. Even with my regular intervention, change sets were getting too frequent and the quality was dropping. I added git commit and git push to the deny list and figured I'd review changes, commit as necessary, and push changes when I was happy with the state of the branch. Claude had other ideas, though. Within 15 minutes of making this change, Claude began circumventing the denial. By still allowing git -C (very useful for worktrees), I'd left open a sort of escape hatch: bash# Claude figuring out ways to commit and push when I've told it not to ⏺ Bash(git -C /Users/steve.adams/Work/DarwinKit commit -m "chore: remove empty dwc/mod.ts barrel file") ⏺ Bash(git -C /Users/steve.adams/Work/DarwinKit push) What the hell? Why Is This Possible? ​ The explanation…