Block Reads of Customer Data Exports Outside Working Hours
A read of a bulk customer-data export at 3am local time is a different risk profile than the same read at 10am — this restricts a configured export path to business hours, so an unattended or compromised session can't quietly pull customer data overnight.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — blocks Read on a customer-data export path outside
9am-6pm local. Wire to the Read matcher."""
import json, re, sys, datetime
data = json.load(sys.stdin)
path = (data.get("tool_input") or {}).get("file_path", "")
if not re.search(r"(?i)/exports?/", path):
sys.exit(0)
hour = datetime.datetime.now().hour
if not (9 <= hour < 18):
print(f"BLOCKED: reads of {path} are only allowed 9:00-18:00 local. "
f"Current hour: {hour}:00.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/block-pii-export-reads-outside-hours.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Read",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/block-pii-export-reads-outside-hours.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks