Settings

Before anything else, verify:

• Not done: settings.local.json is NOT committed to git
• Not done: No hardcoded API keys, tokens, or passwords
• Not done: No sensitive paths exposed in permissions
• Not done: No dangerous command auto-approvals

If ANY of these fail, FLAG IMMEDIATELY as CRITICAL and stop review.

Multi-Pass Review Strategy

First Pass: Committed Settings Detection

CRITICAL SECURITY ISSUE: settings.local.json in git

settings.local.json must NEVER be committed. It contains user-specific and potentially sensitive configuration.

Detection: Check if settings.local.json appears in changed files list. If present in git diff or PR, this is CRITICAL.

Fix:

Rationale: Local settings may contain:

• User-specific file paths
• API keys or tokens
• Personal preferences
• Machine-specific configuration

Committing these exposes sensitive data and creates conflicts between users.

Second Pass: Hardcoded Secrets

Scan for Common Secret Patterns:

❌ CRITICAL ISSUES:

✅ SAFE ALTERNATIVES:

Common Secret Patterns:

• apiKey, api_key, API_KEY
• password, passwd, pwd
• token, auth_token, access_token
• secret, shared_secret
• Keys starting with sk-, ghp_, gho_, etc.

Third Pass: Permission Scoping

Appropriate Permission Scoping:

❌ TOO BROAD:

✅ APPROPRIATELY SCOPED:

Permission Guidelines:

Read Permissions:

• Scope to project directory and relevant config
• Avoid Read://* (entire filesystem)
• Consider what actually needs to be read

Write Permissions:

• Even more restrictive than Read
• Limit to source directories, not config or root
• Avoid write access outside project

Bash Permissions:

• Specific commands, not Bash:*
• Safe operations: git status, npm install, ./gradlew test
• NEVER auto-approve: rm -rf, dd, chmod 777, curl | sh

Fourth Pass: Command Auto-Approval Safety

Safe vs Dangerous Commands:

✅ SAFE to auto-approve:

❌ DANGEROUS - require approval:

Safety Criteria:

• Read-only operations: Generally safe (ls, git status, git diff)
• Idempotent operations: Safe to run multiple times (npm install, git pull)
• Destructive operations: Require approval (rm, force push, formatting)
• External code execution: Require approval (curl | sh, wget | bash)

Fifth Pass: JSON Syntax and Structure

Common JSON Issues:

❌ Syntax errors:

✅ Valid JSON:

Field Validation:

• Check field names against Claude Code documentation
• Verify value types (string, boolean, array, object)
• Ensure required fields are present
• Remove unknown or deprecated fields

Priority Classification

Classify findings using reference/priority-framework.md:

• CRITICAL - Prevents functionality or exposes security vulnerabilities
• IMPORTANT - Significantly impacts quality or maintainability
• SUGGESTED - Improvements that aren’t essential
• OPTIONAL - Personal preferences