Skip to main content
CC Safety Net blocks these commands because they can permanently destroy data — uncommitted changes, stashed work, or remote history. The list below covers the default built-in rules; custom rules can extend this list.

​
Git Commands

These git operations are blocked because they discard uncommitted work, destroy recovery history, or rewrite shared state.
Command PatternWhy It’s Blocked
git checkout -- <files>Discards uncommitted changes permanently
git checkout --force / -fForce-discards uncommitted changes
git checkout <ref> -- <path>Overwrites working tree with ref version
git checkout <ref> <path>May overwrite working tree when Git disambiguates ref vs pathspec
git checkout --pathspec-from-fileCan overwrite multiple files from a file list
git restore <files>Discards uncommitted changes (use --staged to only unstage)
git restore --worktree / -WExplicitly discards working tree changes
git switch --discard-changesDiscards uncommitted changes when switching branches
git switch --force / -fDiscards uncommitted changes (force switch)
git reset --hardDestroys all uncommitted changes
git reset --mergeCan lose uncommitted changes
git clean -f / --forceRemoves untracked files permanently
git push --force / -fDestroys remote history (use --force-with-lease)
git branch -DForce-deletes branch without merge check
git rebase --abortDiscards rebase conflict resolutions
git merge --abortDiscards merge conflict resolutions
git tag -d / --deletePermanently deletes tags
git reflog deleteRemoves recovery history
git stash dropPermanently deletes stashed changes
git stash clearDeletes ALL stashed changes
git worktree remove --forceForce-deletes worktree without checking for changes
Git commands that mutate a branch with both a force flag and a create/reset flag (for example git checkout -Bf, git switch -Cf --discard-changes) are treated as forced branch resets and blocked.

​
Git SSH environment overrides

Git accepts GIT_SSH_COMMAND, GIT_SSH, and GIT_SSH_VARIANT to run an arbitrary program during network operations. CC Safety Net blocks any of these overrides when combined with a network subcommand, because they can execute arbitrary commands:
Blocked patternWhy It’s Blocked
GIT_SSH_COMMAND=... git cloneSSH override can execute arbitrary commands during network ops
GIT_SSH=... git fetch / pull / pushSame — applies to fetch, pull, push
GIT_SSH_VARIANT=... git ls-remote / submoduleSame — applies to ls-remote and submodule

​
Filesystem Commands

Command PatternWhy It’s Blocked
rm -rf /, ~, $HOMERoot/home deletion is extremely dangerous and always blocked
rm -rf . (the cwd itself)Deleting the whole working directory is treated as outside-cwd
rm -rf on dynamic targetsTargets containing $ or backticks can’t be verified and are blocked
rm -rf outside the cwdRecursive deletion of absolute, parent, or non-temp paths outside the cwd is blocked
rm -rf while the cwd is your homeBlocked — change into a project directory first
find ... -deletePermanently removes files matching criteria (use -print to preview)
find -exec rm -rf ...Recursive-force delete inside a find exec block is blocked
xargs rm -rfDynamic input makes targets unpredictable
xargs <shell> -cCan execute arbitrary commands
parallel rm -rfDynamic input makes targets unpredictable
parallel <shell> -cCan execute arbitrary commands
rm -rf is classified by target: root/home, dynamic, cwd-self (.), home-cwd, and outside-cwd targets are blocked; temp paths (/tmp, /var/tmp, the system temp dir, $TMPDIR) and paths inside the current working directory are allowed. See Commands Allowed for the safe variants.
Commands like dd, mkfs, and shred are not blocked as bare top-level commands. They are only caught when they appear inside an interpreter one-liner or unparseable command text that CC Safety Net scans for dangerous patterns. A bare dd if=/dev/zero of=/dev/sda is allowed through — if you need these blocked in your environment, add a custom rule.

​
Shell Wrappers and Interpreter One-Liners

Commands wrapped in shell interpreters like bash -c or sh -c are also blocked. CC Safety Net recursively analyzes nested wrappers up to 10 levels deep, so there is no bypass through indirection. 
bash -c 'git reset --hard'                       # Blocked
sh -lc 'rm -rf /'                                # Blocked
Destructive code embedded in interpreter one-liners is detected and blocked by default. CC Safety Net extracts the code passed to an interpreter’s -c or -e flag and scans it for embedded destructive operations, so an agent cannot sneak os.system("rm -rf /") past the hook by wrapping it in a Python or Node call. 
python -c 'import os; os.system("rm -rf /")'     # Blocked by default (embedded rm -rf detected)
node -e 'require("child_process").exec("git reset --hard")'  # Blocked by default
The analyzed interpreters are python, python2, python3, node, ruby, and perl. It is the embedded destructive command that triggers the block — the one-liner form alone is allowed by default.

​
Blocking all interpreter one-liners

If you want to block interpreter one-liners outright regardless of their content, set CC_SAFETY_NET_PARANOID_INTERPRETERS=1. Every python -c, node -e, ruby -e, and perl -e one-liner is then blocked, even if it contains no dangerous code. See Modes.
The explain command lets you trace exactly why CC Safety Net blocks or allows any specific command. See the CLI Commands reference.