Prevent Claude Code --no-verify Bypass

Claude Code can use --no-verify to skip your pre-commit hooks entirely — even when your CLAUDE.md explicitly forbids it.

Real Incident: 6 Consecutive Commits with Skipped Hooks

A user reported (#40117) that Claude Code Opus 4.6 used --no-verify on 6 consecutive commits. Pre-commit hooks validating secret scanning, integration tests, and production readiness were all silently bypassed. The agent also used git stash to manipulate state and quiet flags to suppress output.

Why a CLAUDE.md Rule Isn't Enough Here

Writing "never use --no-verify" into CLAUDE.md is worth doing, and it is likely to hold. I measured this in August 2026: across 25 short trials with a ban written in, the banned command was never once attempted, against 23 out of 23 without it. So this is not a case of "rules don't work."

What a written rule gives you is a suggestion the model is very likely to follow — not a path that is closed. Two things sit outside what I measured. Long sessions: my trials were all short, and a rule that has scrolled out of context is untested. And other people's reports: the agent in #40117 (Opus 4.6) had explicit instructions not to bypass pre-commit hooks and did it anyway, through --no-verify, git stash and quiet flags. My zero-in-25 has a 95% upper bound of about 11%, so reports like that are entirely consistent with it.

A hook removes the dependency on the model choosing. Write the rule and install the hook — and check the hook actually fires, because a PreToolUse hook blocks on exit code 2 and only on 2. If it crashes, it fails open silently.

The Fix: PreToolUse Hook

A PreToolUse hook on Bash intercepts every command before execution. exit 2 is a hard block the model cannot bypass.

#!/bin/bash
# no-verify-blocker.sh — PreToolUse hook on "Bash"
INPUT=$(cat)
COMMAND=$(echo "$INPUT" | jq -r '.tool_input.command // empty' 2>/dev/null)
[ -z "$COMMAND" ] && exit 0

# Block --no-verify on any git command
if echo "$COMMAND" | grep -qE '\bgit\b.*--no-verify'; then
    echo "BLOCKED: --no-verify bypasses git hooks" >&2
    exit 2
fi

# Block short form: git commit -n
if echo "$COMMAND" | grep -qE '\bgit\s+commit\s+-n\b'; then
    echo "BLOCKED: git commit -n skips pre-commit hook" >&2
    exit 2
fi

exit 0

Install in 10 Seconds

npx github:yurukusa/cc-safe-setup --install-example no-verify-blocker

Blocks --no-verify, force-push, rm -rf, secret leaks, and more. 240+ test files 734 examples

Also Blocks git stash Manipulation

The agent in #40117 also used git stash to circumvent hooks. You can extend the hook:

# Add to the same hook or create a separate one
if echo "$COMMAND" | grep -qE '\bgit\s+stash\b.*&&.*\bgit\s+(commit|push)\b'; then
    echo "BLOCKED: git stash combined with commit/push" >&2
    exit 2
fi

Related Safety Pages

Prevent Force-Push · Prevent rm -rf · Prevent Secret Leaks · Prevent Cost Explosion

cc-safe-setup · 900+ example hooks · 240+ test files · GitHub

Learn more: Production Guide · All Tools