Claude Code's git push deny rule blocked only 8 of 14 push attempts in security test

A developer tested Claude Code version 2.1.278 to see how reliably a single deny rule — Bash(git push:*) — blocks push commands in an automated agent setup. Across 14 differently worded push attempts run on 22 September 2026, the rule successfully blocked 8 but allowed 5 to actually reach the remote repository. Bypasses included indirect methods such as wrapping the command in a shell script, using eval, or invoking git with a -c flag prefix. A 14th attempt evaded the rule but failed independently for unrelated shell reasons. The findings highlight that Claude Code's permission deny rules match command strings literally, leaving meaningful gaps when commands are rephrased or wrapped.