{"name":"secDefault","slug":"secdefault","family":"setting","title":"Settings keys","noun":"settings key","description":"A new sec-default hooks module blocks plugins from bypassing policy settings and MCP server allowlists on managed and Team\/Enterprise accounts","description_source":"entry","described_by":{"version":"2.1.267","anchor":"new-sec-default-hooks-module-locks-plugins-out-of-classic"},"presence":{"first_seen":"2.1.267","removed_in":"2.1.268","in_current_build":false,"newest_mined":"2.1.319","builds":1,"mined_builds":159,"first_cited":{"version":"2.1.267","released_at":"2026-09-09 18:25:42","spans":3}},"aliases":[],"entries":[{"version":"2.1.268","anchor":"secdefault-managed-settings-key-removed","heading":"\"secDefault\" managed-settings key removed","line":"The `secDefault` managed-settings key has been removed entirely","released_at":"2026-09-10 18:41:11","reason":"found in this entry's text, named in this entry"},{"version":"2.1.268","anchor":"managed-plugins-can-pin-hook-ordering-with-prependpluginsap","heading":"Managed plugins can pin hook ordering with prependPlugins\/appendPlugins","line":"Org admins can now pin specific plugins to run first or last among hooks","released_at":"2026-09-10 18:41:11","reason":"found in this entry's text"},{"version":"2.1.268","anchor":"security-default-hooks-module-opt-out-changed-from-a-boolean","heading":"Security-default hooks module opt-out changed from a boolean to a prependPlugins allowlist","line":"Org opt-out for the built-in security-default hooks now uses a prependPlugins allowlist instead of a simple on\/off setting","released_at":"2026-09-10 18:41:11","reason":"found in this entry's text"},{"version":"2.1.267","anchor":"new-sec-default-hooks-module-locks-plugins-out-of-classic","heading":"New \"sec-default\" hooks module locks plugins out of classic hooks\/prompt\/settings\/tool policy for managed orgs","line":"A new sec-default hooks module blocks plugins from bypassing policy settings and MCP server allowlists on managed and Team\/Enterprise accounts","released_at":"2026-09-09 18:25:42","reason":"found in this entry's text"},{"version":"2.1.267","anchor":"user-writable-settings-files-can-no-longer-set-secdefaultpr","heading":"User-writable settings files can no longer set secDefault\/prependPlugins\/appendPlugins or enable plugins via enabledPlugins","line":"User-writable settings files can no longer set secDefault, prependPlugins, appendPlugins, or enable plugins","released_at":"2026-09-09 18:25:42","reason":"found in this entry's text"},{"version":"2.1.267","anchor":"managed-policy-plugin-seating-warnings-for-prependappend-co","heading":"Managed-policy plugin seating warnings for prepend\/append conflicts","line":"New warnings flag when a managed plugin's ordering or a settings key gets silently overridden by managed policy","released_at":"2026-09-09 18:25:42","reason":"found in this entry's text"},{"version":"2.1.267","anchor":"new-policy-setting-maxeffortlevel","heading":"New policy setting: maxEffortLevel","line":"New managed-settings keys maxEffortLevel and secDefault added as policy-restrictive settings","released_at":"2026-09-09 18:25:42","reason":"found in this entry's text"},{"version":"2.1.267","anchor":"security-default-secdefault-plugin-isolates-classic-hoo","heading":"'Security default' (secDefault) plugin: isolates classic hooks\/settings from user-installed plugins","line":"New built-in 'Security default' plugin shields org hooks and settings from user-installed plugins","released_at":"2026-09-09 18:25:42","reason":"found in this entry's text, named in this entry"},{"version":"2.1.267","anchor":"managed-settings-only-secdefault-flag-controls-seating-of","heading":"Managed-settings-only secDefault flag controls seating of the bundled sec-default plugin","line":"A new managed-settings-only flag lets organizations put their bundled sec-default plugin ahead of user-installed plugin hooks","released_at":"2026-09-09 18:25:42","reason":"found in this entry's text, named in this entry"},{"version":"2.1.267","anchor":"security-default-hooks-module-locked-to-managedteam-enterpr","heading":"Security-default hooks module locked to managed\/Team-Enterprise settings","line":"A locked-down 'Security default' hooks module restricts what installed plugins can touch","released_at":"2026-09-09 18:25:42","reason":"named in this entry"}],"entries_total":10,"docs":[],"docs_total":0,"gates":[],"related":[],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/secdefault","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}