{"record":{"id":"8344a4dfefaea602","repo":"continuedev/continue","slug":"reading-or-editing-filepath-is-not-allowed-beca","errorCode":null,"errorMessage":"Reading or Editing ${filepath} is not allowed because it is a security concern. Do not attempt to read or edit this file in any way.","messagePattern":"Reading or Editing (.+?) is not allowed because it is a security concern\\. Do not attempt to read or edit this file in any way\\.","errorType":"exception","errorClass":"ContinueError","httpStatus":null,"severity":"error","filePath":"core/indexing/ignore.ts","lineNumber":259,"sourceCode":"  }\n  let filepath = filePathOrUri;\n  try {\n    filepath = fileURLToPath(filePathOrUri);\n  } catch {}\n  if (path.isAbsolute(filepath)) {\n    const dir = path.dirname(filepath).split(/\\/|\\\\/).at(-1) ?? \"\";\n    const basename = path.basename(filepath);\n    filepath = `${dir ? dir + \"/\" : \"\"}${basename}`;\n  }\n  if (!filepath) {\n    return false;\n  }\n  return defaultFileAndFolderSecurityIgnores.ignores(filepath);\n}\n\nexport function throwIfFileIsSecurityConcern(filepath: string) {\n  if (isSecurityConcern(filepath)) {\n    throw new ContinueError(\n      ContinueErrorReason.FileIsSecurityConcern,\n      `Reading or Editing ${filepath} is not allowed because it is a security concern. Do not attempt to read or edit this file in any way.`,\n    );\n  }\n}\n\nexport function gitIgArrayFromFile(file: string) {\n  return file\n    .split(/\\r?\\n/) // Split on new line\n    .map((l) => l.trim()) // Remove whitespace\n    .filter((l) => !/^#|^$/.test(l)); // Remove empty lines\n}\n","sourceCodeStart":241,"sourceCodeEnd":272,"githubUrl":"https://github.com/continuedev/continue/blob/5522c6f44ca0ac3528b37244818fbfa39b5af470/core/indexing/ignore.ts#L241-L272","documentation":"Thrown by throwIfFileIsSecurityConcern before any read or edit of a file matching default security ignore patterns (e.g. .env, credentials, keys). The library hard-blocks access to sensitive files regardless of user intent, and the message tells the model never to retry them.","triggerScenarios":"Any read/edit tool call whose resolved path matches the built-in security ignore list: .env files, SSH keys, token/credential files, and similar sensitive artifacts.","commonSituations":"LLM agents attempting to 'fix config' by editing .env; automated refactors that glob over a repo and hit dotfiles/credential files; users trying to read secrets to debug environment issues.","solutions":["Do not read or edit the flagged file; work with a sanitized example (e.g. .env.example) instead","Move secrets out of the blocked file and into your secret manager, then edit the non-secret config","If you truly must inspect it, do so manually outside the tooling — do not attempt to bypass the guard"],"exampleFix":"// before\nawait readFile({ filepath: \".env\" });\n// after\nawait readFile({ filepath: \".env.example\" });","handlingStrategy":"validation","validationCode":"const SENSITIVE = [/\\.env/, /id_rsa/, /(credential|secret|token)s?/i]; if (SENSITIVE.some(r => r.test(filepath))) throw new Error('refusing sensitive file');","typeGuard":"const isSafePath = (fp: string) => !/(^|\\/)\\.(env|ssh|aws|gnupg)|secret|credential|private.*key/i.test(fp);","tryCatchPattern":"catch (e) { if (e.message.includes('security concern')) { useExampleFileInstead(); } else throw e; }","preventionTips":["Never point tools at .env or key files","Edit .example templates instead","Keep secrets in a manager, not files agents can reach"],"tags":["security","file-access","blocked","secrets"],"backgroundTag":"sensitive-file-access-blocked","analyzedSha":"5522c6f44ca0ac3528b37244818fbfa39b5af470","analyzedAt":"2026-08-27T11:28:54.683Z","schemaVersion":2},"datasetVersion":"2026-08-27T13:17:12.746Z"}