Claude wiped my friend's production .env (definitely not mine). I wrote him a guide.

My friend - who is not me - gave Claude a shell, a repo, and a .env full of production credentials, then clicked "Yes, don't ask again" one too many times. My friend even had a deny rule. It didn't fire. Here's the guide I wrote him. What wouldn't have saved