Security changedsecurity
Nearest release: v2.1.302, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 16 Oct 2026 20:11 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+8added
Lines−8removed
From line
62
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits12to this page, all time
The whole hunk
from line 62, old and new numbered
/
from line 62
6262* **Fail-closed matching**: In Manual mode, unmatched commands require approval by default
6363* **Secure credential storage**: API keys and tokens are stored in the macOS Keychain when available. On Linux they're stored in a file with mode `0600`, and on Windows in a file that inherits the access controls of your user profile directory. See [Credential Management](/docs/en/authentication#credential-management)
6464
65<Warning>
66 **Windows WebDAV security risk**: When running Claude Code on Windows, we recommend against enabling WebDAV or allowing Claude Code to access paths such as `\\*` that may contain WebDAV subdirectories. [WebDAV has been deprecated by Microsoft](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features#:~:text=The%20Webclient%20\(WebDAV\)%20service%20is%20deprecated) due to security risks. Enabling WebDAV may allow Claude Code to trigger network requests to remote hosts, bypassing the permission system.
67</Warning>
65> [!WARNING]
66>
67> **Windows WebDAV security risk**: When running Claude Code on Windows, we recommend against enabling WebDAV or allowing Claude Code to access paths such as `\\*` that may contain WebDAV subdirectories. [WebDAV has been deprecated by Microsoft](https://learn.microsoft.com/en-us/windows/whats-new/deprecated-features#:~:text=The%20Webclient%20\(WebDAV\)%20service%20is%20deprecated) due to security risks. Enabling WebDAV may allow Claude Code to trigger network requests to remote hosts, bypassing the permission system.
6868
6969**Best practices for working with untrusted content**:
7070
from line 74
74744. Use virtual machines (VMs) to run scripts and make tool calls, especially when interacting with external web services
75755. Report suspicious behavior with `/feedback`
7676
77<Warning>
78 While these protections significantly reduce risk, no system is completely
79 immune to all attacks. Always maintain good security practices when working
80 with any AI tool.
81</Warning>
77> [!WARNING]
78>
79> While these protections significantly reduce risk, no system is completely
80> immune to all attacks. Always maintain good security practices when working
81> with any AI tool.
8282
8383## MCP security
8484
No line in this hunk matches that.