Turn on the sandbox
The sandbox matters most because the operating system enforces it on the running process, while permission rules only match command text, which can be rephrased. Two defaults catch people out:
- The default read policy still allows
~/.aws/credentialsand~/.ssh/, so you have to deny them explicitly. - Broad allowlist entries such as
github.com, paste sites and webhook services are exfiltration channels, because the proxy filters by hostname and doesn’t inspect what you send.
Turn on strict mode (allowUnsandboxedCommands: false), limit the network allowlist to the registries you use, and deny credential files. The audit’s fix section has a baseline settings.json with each setting explained.