fix(security): ignore .claude/settings.local.json and pin in security_guards (#551) (#552)

.gitignore

@@ -51,6 +51,7 @@ Thumbs.db
 
 # Memory files (Claude Code user-specific)
 .claude/projects/
+.claude/settings.local.json
 
 # Skills lock (auto-generated)
 skills-lock.json

CHANGELOG.md

@@ -29,6 +29,12 @@ per-file diff commands.
 
 ### Fixed
 
+- **`.claude/settings.local.json` is ignored in `.gitignore` and pinned in security guards** (#551,
+  `.gitignore`, `tools/security_guards.py`) - Claude Code stores machine-local settings and
+  ad-hoc tool approvals in `.claude/settings.local.json`. The file is now excluded from version
+  control in `.gitignore` and pinned in `REQUIRED_IGNORE_RULES` to prevent fork users from
+  accidentally committing local session configurations.
+
 - **`/rank` retires scored jobs whose preserved deadline has passed**
   (`tools/rank_state.py`, `tests/test_rank_state.py`) - a fresh `null` deadline
   preserves the stored date, but `apply` previously wrote the job as `ranked`

tools/security_guards.py

@@ -110,6 +110,8 @@ REQUIRED_IGNORE_RULES = [
     # from commands, not a skill, so a plain rooted rule is correct here -
     # unlike the **/-prefixed job_scraper/upskill rules above.
     "company_research/*.json",
+    # Machine-local Claude Code user configuration and ad-hoc permissions approvals.
+    ".claude/settings.local.json",
 ]
 
 # Negation (re-include) rules the template legitimately ships. .gitignore is