secDefault
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.267 and was gone by v2.1.268.
A new sec-default hooks module blocks plugins from bypassing policy settings and MCP server allowlists on managed and Team/Enterprise accounts
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.267.
In the changelogs
10Releases whose published page names secDefault.
-
v2.1.268
"secDefault" managed-settings key removed
The
secDefaultmanaged-settings key has been removed entirelyfound in this entry's text, named in this entry
-
v2.1.268
Managed plugins can pin hook ordering with prependPlugins/appendPlugins
Org admins can now pin specific plugins to run first or last among hooks
found in this entry's text
-
v2.1.268
Security-default hooks module opt-out changed from a boolean to a prependPlugins allowlist
Org opt-out for the built-in security-default hooks now uses a prependPlugins allowlist instead of a simple on/off setting
found in this entry's text
-
v2.1.267
New "sec-default" hooks module locks plugins out of classic hooks/prompt/settings/tool policy for managed orgs
A new sec-default hooks module blocks plugins from bypassing policy settings and MCP server allowlists on managed and Team/Enterprise accounts
found in this entry's text
-
v2.1.267
User-writable settings files can no longer set secDefault/prependPlugins/appendPlugins or enable plugins via enabledPlugins
User-writable settings files can no longer set secDefault, prependPlugins, appendPlugins, or enable plugins
found in this entry's text
-
v2.1.267
Managed-policy plugin seating warnings for prepend/append conflicts
New warnings flag when a managed plugin's ordering or a settings key gets silently overridden by managed policy
found in this entry's text
-
v2.1.267
New policy setting: maxEffortLevel
New managed-settings keys maxEffortLevel and secDefault added as policy-restrictive settings
found in this entry's text
-
v2.1.267
'Security default' (secDefault) plugin: isolates classic hooks/settings from user-installed plugins
New built-in 'Security default' plugin shields org hooks and settings from user-installed plugins
found in this entry's text, named in this entry
-
v2.1.267
Managed-settings-only
secDefaultflag controls seating of the bundled sec-default pluginA new managed-settings-only flag lets organizations put their bundled sec-default plugin ahead of user-installed plugin hooks
found in this entry's text, named in this entry
-
v2.1.267
Security-default hooks module locked to managed/Team-Enterprise settings
A locked-down 'Security default' hooks module restricts what installed plugins can touch
named in this entry
First cited
3The earliest release whose published evidence quoted secDefault was v2.1.267, 9 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
2Build by build
49One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.