How to protect your files in Claude Code

Did your agent modify a file it shouldn’t have? There are two ways to prevent it, and both take minutes to set up.

Method 1: .claudeignore

It works just like .gitignore. You create the file at the project root and list everything the agent must not touch: environment variables, config files, build folders, whatever you need.

Claude Code reads it automatically and avoids reading or modifying those files. One line per file or folder, and that’s it.

.env
.env.local
/config/secrets.js
/dist
/node_modules

It’s the ideal option for sensitive files: credentials, secrets, and generated artifacts that nobody should edit by hand.

Method 2: restrictions in AGENTS.md

The second method is adding a restrictions section to your AGENTS.md. It’s useful for more specific rules: not just which files not to touch, but also which actions not to take.

markdown

## Restrictions
- Do not modify files in /migrations
- Do not update package.json without asking
- Do not touch /lib/auth without an approved PR

The difference from .claudeignore is that here you can be more descriptive. You can explain to the agent why it shouldn’t do something, not just what. And an agent that understands the reason behind a rule applies it better in situations you didn’t anticipate.

For example, instead of just “Do not modify /migrations”, you could add: “Migrations already applied in production are never edited; if a change is needed, create a new migration.”

When to use each one

Coming up: hooks

There’s a third way to control what the agent does: hooks. But that deserves a full video, so we’ll cover it in the next episode.

Use them together

Each one covers a different part of the problem:

.claudeignore → sensitive files
AGENTS.md     → business rules

With both in place, your agent will know exactly where not to go. Save this article for the next time you start a project: ideally, set up both files before writing the first line of code.