---
title: "How to protect your files in Claude Code"
description: "Two ways to keep your coding agent away from sensitive files: .claudeignore for what it can't touch and AGENTS.md for your business rules."
url: "https://www.devlights.com/blog/protect-files-claude-code"
language: en
published: 2026-11-06T13:08:34.820Z
updated: 2026-11-06T15:23:14.424Z
type: article
authors: ["Sara Zamudio"]
category: "Tech Tips"
tags: ["Claude", "Claude Code", "Coding agents", "AI"]
---

# How to protect your files in Claude Code

> Two ways to stop your agent from touching files it shouldn't: .claudeignore for sensitive files and restrictions in AGENTS.md for your business rules.

Did your agent modify a file it shouldn’t have? There are two ways to prevent it, and both take minutes to set up.

### Method 1: .claudeignore

It works just like `.gitignore`. You create the file at the project root and list everything the agent must not touch: environment variables, config files, build folders, whatever you need.

Claude Code reads it automatically and avoids reading or modifying those files. One line per file or folder, and that’s it.

```
.env
.env.local
/config/secrets.js
/dist
/node_modules
```

It’s the ideal option for **sensitive files**: credentials, secrets, and generated artifacts that nobody should edit by hand.

### Method 2: restrictions in AGENTS.md

The second method is adding a restrictions section to your [AGENTS.md](https://www.devlights.com/blog/agents-md-coding-agent-instructions). It’s useful for more specific rules: not just which files not to touch, but also which actions not to take.

markdown

```markdown
## Restrictions
- Do not modify files in /migrations
- Do not update package.json without asking
- Do not touch /lib/auth without an approved PR
```

The difference from `.claudeignore` is that here you can be more descriptive. You can explain to the agent **why** it shouldn’t do something, not just what. And an agent that understands the reason behind a rule applies it better in situations you didn’t anticipate.

For example, instead of just “Do not modify /migrations”, you could add: “Migrations already applied in production are never edited; if a change is needed, create a new migration.”

### When to use each one

|  | .claudeignore | AGENTS.md (restrictions) |
| --- | --- | --- |
| **Used for** | Sensitive files and folders | Business rules and actions |
| **Format** | One line per path | Free text, with explanation |
| **Example** | `.env`, `/dist`, `/node_modules` | “Don’t update dependencies without asking” |
| **Best for** | Which files not to touch | Which actions not to take, and why |

### Coming up: hooks

There’s a third way to control what the agent does: **hooks**. But that deserves a full video, so we’ll cover it in the next episode.

### Use them together

Each one covers a different part of the problem:

```
.claudeignore → sensitive files
AGENTS.md     → business rules
```

With both in place, your agent will know exactly where not to go. Save this article for the next time you start a project: ideally, set up both files before writing the first line of code.