{"version":"1.0.111","anchor":"environment-variable-whitelist","canonical_anchor":"environment-variable-whitelist","heading":"Environment Variable Whitelist","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/1.0.111\/e\/environment-variable-whitelist","release_url":"https:\/\/changelogs.core-directive.com\/v\/1.0.111","markdown":"### Environment Variable Whitelist\n\n**What:** Settings files (`.claude\/settings.json` and `.claude\/settings.local.json`) can now only set specific whitelisted environment variables.\n\n**Details:**\n\n- 45 allowed environment variables including:\n- API configuration: `ANTHROPIC_API_KEY`, `ANTHROPIC_MODEL`\n- Feature flags: `DISABLE_TELEMETRY`, `DISABLE_ERROR_REPORTING`\n- Proxy settings: `HTTP_PROXY`, `HTTPS_PROXY`\n- Tool timeouts: `BASH_MAX_TIMEOUT_MS`, `MCP_TIMEOUT`\n- Prevents arbitrary environment variable injection via settings files\n- Security enhancement to protect against potential configuration exploits\n- **Evidence**: `YCB` Set at lines 427822-427867, `WCB()` at line 427868"}