Block Writes to a Named Prod-Config Path
Pins down one specific blast-radius path instead of relying on a human remembering not to touch it: a glob of production config files (nginx vhosts, `settings_production.py`, a deploy manifest) is blocked outright unless `ALLOW_PROD_EDIT=1` is set in the environment for that one command.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — blocks Write/Edit on a configured production-config
path unless an explicit override env var is set. Wire to Write|Edit."""
import json, os, re, sys
data = json.load(sys.stdin)
path = (data.get("tool_input") or {}).get("file_path", "")
PROD_PATHS = [r"settings_production\.py$", r"/etc/nginx/", r"deploy_manifest\."]
if os.environ.get("ALLOW_PROD_EDIT") == "1":
sys.exit(0)
if any(re.search(p, path) for p in PROD_PATHS):
print(f"BLOCKED: {path} matches a production-config path. "
f"Set ALLOW_PROD_EDIT=1 to confirm this edit is intentional.", file=sys.stderr)
sys.exit(2)
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/block-writes-to-prod-config-path.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"matcher": "Write|Edit",
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/block-writes-to-prod-config-path.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks