2 changed files with 9 additions and 1 deletions
@@ -166,7 +166,9 @@
      "Bash(npx @claude-flow*)",
      "Bash(npx claude-flow*)",
      "Bash(node .claude/*)",
-      "mcp__claude-flow__:*"
+      "mcp__claude-flow__:*",
+      "Bash(docker *)",
+      "Bash(docker compose *)"
    ],
    "deny": ["Read(./.env)", "Read(./.env.*)"]
  },
@@ -24,6 +24,12 @@ apps/web/e2e/.playwright-runtime.json
 .env.test.local
 .env.production.local
 .env.*.local
+# Hand-made or tool-made copies of .env — these carry the same secrets as the
+# original but match none of the patterns above (.env.bak-20260911, .env.save).
+.env.bak*
+.env.backup*
+.env.orig
+.env.save
 *.e2e-backup

 # Logs