Claude Code deny rule Bash(git push:*) stopped 8 of 14 push variants

A tester ran 14 spellings of a git push command against Claude Code 2.1.278 with a deny rule Bash(git push:*) in .claude/settings.json. The rule blocked 8 variants, while 5 reached the remote via git -c, quoting, sh -c, eval and an external script.

• The deny rule blocked 8 of 14 push variants
• 5 variants bypassed the rule and pushed to the remote
• Bypasses used git -c, git 'push', sh -c, eval and a shell script
• One variant failed in the shell rather than being blocked