{
  "permissions": {
    "deny": [
      "Bash(rm -rf:*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/secrets/**)"
    ]
  }
}