{
  "PreToolUse": [
    {
      "matcher": "Read|Write|Edit",
      "hooks": [
        {
          "type": "command",
          "command": "FILE=$(jq -r '.tool_input.file_path // .tool_input.path // empty'); if echo "$FILE" | grep -qE '(\.env$|\.env\.|credentials|secrets|private.*key)'; then echo 'BLOCKED: Attempted to access sensitive file: '$FILE; exit 1; fi; exit 0"
        }
      ]
    }
  ]
}