diff --git a/dotfiles/settings.json b/dotfiles/settings.json
index 53ca122..6bdc5c2 100644
--- a/dotfiles/settings.json
+++ b/dotfiles/settings.json
@@ -7,11 +7,75 @@
       "WebSearch",
       "Bash(npm install)",
       "Bash(ls:*)",
-      "Bash(python3:*)"
+      "Bash(python3:*)",
+      "Read(/home/martin/.claude/**)",
+      "Bash(find *)",
+      "Bash(cat *)",
+      "Bash(git log*)",
+      "Bash(git diff*)",
+      "Bash(git status*)",
+      "Bash(git show*)",
+      "Bash(git branch*)",
+      "mcp__gitea__get_me",
+      "mcp__gitea__get_file_contents",
+      "mcp__gitea__get_dir_contents",
+      "mcp__gitea__get_commit",
+      "mcp__gitea__get_latest_release",
+      "mcp__gitea__get_release",
+      "mcp__gitea__get_tag",
+      "mcp__gitea__get_repository_tree",
+      "mcp__gitea__get_user_orgs",
+      "mcp__gitea__get_gitea_mcp_server_version",
+      "mcp__gitea__list_branches",
+      "mcp__gitea__list_commits",
+      "mcp__gitea__list_issues",
+      "mcp__gitea__list_my_repos",
+      "mcp__gitea__list_org_repos",
+      "mcp__gitea__list_pull_requests",
+      "mcp__gitea__list_releases",
+      "mcp__gitea__list_tags",
+      "mcp__gitea__issue_read",
+      "mcp__gitea__label_read",
+      "mcp__gitea__milestone_read",
+      "mcp__gitea__pull_request_read",
+      "mcp__gitea__search_issues",
+      "mcp__gitea__search_org_teams",
+      "mcp__gitea__search_repos",
+      "mcp__gitea__search_users",
+      "mcp__gitea__timetracking_read",
+      "mcp__gitea__wiki_read",
+      "mcp__gitea__actions_config_read",
+      "mcp__gitea__actions_run_read",
+      "Bash(jq *)",
+      "mcp__gitea__pull_request_write",
+      "mcp__gitea__pull_request_review_write",
+      "mcp__gitea__issue_write",
+      "mcp__plugin_context7_context7__query-docs",
+      "mcp__plugin_context7_context7__resolve-library-id",
+      "Bash(git checkout *)",
+      "Bash(git add *)",
+      "Bash(git commit *)",
+      "Bash(git push *)",
+      "Bash(git stash *)",
+      "Bash(docker compose *)",
+      "Bash(docker *)",
+      "Bash(which *)"
     ],
     "defaultMode": "default"
   },
   "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "bash /mnt/projekte/claude-workflow/hooks/pre-bash-checks.sh",
+            "statusMessage": "Prüfe Bash-Sicherheitsregeln..."
+          }
+        ]
+      }
+    ],
     "PostToolUse": [
       {
         "matcher": "Edit|Write",
@@ -46,5 +110,7 @@
     "code-simplifier@claude-plugins-official": true,
     "skill-creator@claude-plugins-official": true
   },
-  "language": "German"
+  "language": "German",
+  "editorMode": "vim",
+  "terminalProgressBarEnabled": false
 }
diff --git a/hooks/pre-bash-checks.sh b/hooks/pre-bash-checks.sh
new file mode 100755
index 0000000..7d07187
--- /dev/null
+++ b/hooks/pre-bash-checks.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+# Globale Sicherheitsprüfungen vor jedem Bash-Tool-Aufruf.
+cmd=$(jq -r '.tool_input.command // ""')
+
+# Git-Branch-Schutz: kein direkter Commit auf main
+if echo "$cmd" | grep -q 'git commit'; then
+  branch=$(git rev-parse --abbrev-ref HEAD 2>/dev/null || echo "")
+  if [ "$branch" = "main" ]; then
+    printf '{"continue":false,"stopReason":"BLOCKIERT: Direkter Commit auf main verboten (globale Regel). Bitte zuerst Feature-Branch erstellen: git checkout -b session/YYYY-MM-DD-titel"}\n'
+    exit 0
+  fi
+fi
+
+# apt -y verboten
+if echo "$cmd" | grep -qE '\bapt\b' && echo "$cmd" | grep -q -- ' -y'; then
+  printf '{"continue":false,"stopReason":"BLOCKIERT: apt -y ist verboten. Bitte ohne -y ausfuehren, damit du die Zusammenfassung selbst bestaetigen kannst."}\n'
+fi