Local — that's the whole mechanism of the leak. The approved commands are saved into settings.local.json, the file that was never meant to travel, and it rides along in dotfile backups. Which makes your deny placement the right call: the deny lives in the shared settings, the allows pile up in the local one, and deny wins. Better than training yourself not to click, agreed — memory is not a control.