py/ai-job-search
1
0
Fork 0
mirror of https://github.com/MadsLorentzen/ai-job-search.git synced 2026-09-17 00:26:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

Tighten pre-approved permissions and untrack settings.local.json (#27)

Browse Source 
* fix: move scoped permissions to settings.json, drop curl, untrack settings.local.json

Addresses #23:
- Remove pre-approved Bash(curl:*) - no agent workflow uses curl, and a
  toolkit that routinely feeds untrusted job postings to the model should
  not ship a pre-approved exfiltration-capable command
- Move shared permissions to .claude/settings.json (committed by
  convention) and scope them tighter: Bash(bun run:*) for the job portal
  CLIs, Bash(python/python3 salary_lookup.py:*) for salary lookups
- Untrack .claude/settings.local.json - it was committed despite being
  listed in .gitignore; the file stays local for personal overrides

Reported-by: @josealfonsomora

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(setup): warn existing cloners about stale settings.local.json

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mads Lorentzen
2026-07-05 10:56:17 +02:00
committed by GitHub
co-authored by Claude Fable 5
parent d8f38fe766
commit f15b9fb65d
4 changed files with 18 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SETUP.md
+7
View File
@@ -164,3 +164,10 @@ Make sure Bun is installed and you ran `bun install` in each CLI directory. The
### Fonts not found in cover letter
The cover letter template expects fonts in `cover_letters/OpenFonts/fonts/`. Make sure this directory exists and contains the Lato and Raleway font files.
### Stale `.claude/settings.local.json` from an older clone
Shared Claude Code permissions now live in `.claude/settings.json` (scoped to `bun run` and `python salary_lookup.py`). Earlier versions of this repo committed a broader `.claude/settings.local.json` that pre-approved `Bash(curl:*)`, `Bash(python:*)` and `Bash(bun:*)`. If you cloned before that change, git leaves the old file behind in your working copy, and its permissions still apply on top of `settings.json`. Delete it (or trim it to your own personal overrides):
```bash
rm .claude/settings.local.json
```