{"version":"2.1.305","anchor":"warning-for-permission-rules-that-use-literally","canonical_anchor":"warning-for-permission-rules-that-use-literally","heading":"Deny and ask rules that treat * literally now get a security notice","tier":"notice","area":"Permissions","scope":"both","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305\/e\/warning-for-permission-rules-that-use-literally","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.305","markdown":"### Deny and ask rules that treat `*` literally now get a security notice\n\nDeny or ask permission rules that mix `*` with `:*` now carry a security notice saying the `*` is read literally, with a fix\n\n**What**\n\nPermission rules decide what Claude Code may do without asking. When a rule mixes a `*` with the trailing `:*` form, Claude Code reads that `*` as a literal character, not as \"anything\". For such rules that are not allow rules, such as deny or ask rules, Claude Code now adds a security notice. It says the rule reads its `*` literally and suggests a corrected version. Before, these rules got only a plain warning.\n\n**Why**\n\nA deny or ask rule that does not match what you expected can let actions through that you meant to block, so this points you to the fix.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: both\n- Heads-up: no"}