{
  "permissions": {
    "allow": ["WebFetch", "WebSearch"],
    "deny": ["Read(./.env)", "Read(./secrets/**)"]
  }
}