Mads LorentzenandClaude Fable 5 f15b9fb65d Tighten pre-approved permissions and untrack settings.local.json (#27) ...

* fix: move scoped permissions to settings.json, drop curl, untrack settings.local.json

Addresses #23:
- Remove pre-approved Bash(curl:*) - no agent workflow uses curl, and a
  toolkit that routinely feeds untrusted job postings to the model should
  not ship a pre-approved exfiltration-capable command
- Move shared permissions to .claude/settings.json (committed by
  convention) and scope them tighter: Bash(bun run:*) for the job portal
  CLIs, Bash(python/python3 salary_lookup.py:*) for salary lookups
- Untrack .claude/settings.local.json - it was committed despite being
  listed in .gitignore; the file stays local for personal overrides

Reported-by: @josealfonsomora

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(setup): warn existing cloners about stale settings.local.json

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-05 10:56:17 +02:00

..

agents

Initial release: AI-powered job application framework

2026-03-23 08:34:06 +01:00

commands

refactor: fold /setup_docs into /setup as third onboarding path (#9)

2026-04-29 09:57:33 +02:00

skills

fix(skills): replace bold markdown with proper YAML Frontmatter (#16)

2026-06-15 21:41:10 +02:00

settings.json

Tighten pre-approved permissions and untrack settings.local.json (#27)

2026-07-05 10:56:17 +02:00