I was running Claude Code on a WordPress plugin repo and got tired of approving git commands one by one. So, without much thought, I dropped Bash(git *) into my allow list. "Git stuff goes through quietly now," about that level of care. I build WordPress plugins most days and Claude Code is part of the routine, so I just wanted one fewer prompt.
A few days later I checked what * actually matches. The docs say it matches any string, including spaces. So Bash(git *) was waving through not just git log --oneline but git push origin main and git reset --hard HEAD~3 too. The range I thought I'd allowed and the range that was actually open were different from the start. You can't tell while it runs. No prompt appearing means exactly that.
Nothing broke. But seeing the git reset line was enough of a near-miss. Having my plugin's working tree quietly rolled back would sting. Since then, I add a few lines to settings.json before launching claude. This is what I dug up and the setup I keep now.
Verification note
Key names and behavior change between versions. The notes below were re-checked against the official docs (Configure permissions and the settings reference) on 2026-06-05. Settle it on your own machine with /permissions and /config to see which file each rule comes from.
