Env Guard — Protect Sensitive Files

Hooks

Prevents agents from reading or editing .env files and other sensitive configuration.

1803/26/2026

json1 file

hooks.json401 B

{
  "PreToolUse": [
    {
      "matcher": "Read|Write|Edit",
      "hooks": [
        {
          "type": "command",
          "command": "FILE=$(jq -r '.tool_input.file_path // .tool_input.path // empty'); if echo "$FILE" | grep -qE '(\.env$|\.env\.|credentials|secrets|private.*key)'; then echo 'BLOCKED: Attempted to access sensitive file: '$FILE; exit 1; fi; exit 0"
        }
      ]
    }
  ]
}