Claude Code starts in bypassPermissions mode

Where the setting is honoured (user and managed settings), in bypassPermissions mode Claude Code skips permission prompts, so the model, or a prompt injected into it, can run commands and edit files without asking you.

client settings checks
3 test fixtures

high bypass-permissions

Flagged

  2     "permissions": {
  3 >     "defaultMode": "bypassPermissions"
  4     }

Fix

Remove "defaultMode": "bypassPermissions" and keep the default mode. Set "permissions.disableBypassPermissionsMode": "disable" to block the mode, and allow only the specific commands you need.

Fine

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

References

https://code.claude.com/docs/en/settings-reference
https://code.claude.com/docs/en/permissions

← All rules

Running agents in production?Qlucent assesses agent permissions and data boundaries. →