{"version":"2.1.234","anchor":"git-remote-urls-can-no-longer-smuggle-a-different-host","canonical_anchor":"git-remote-urls-can-no-longer-smuggle-a-different-host","heading":"Git remote URLs can no longer smuggle a different host","tier":"notice","area":"Git Integration","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234\/e\/git-remote-urls-can-no-longer-smuggle-a-different-host","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.234","markdown":"### Git remote URLs can no longer smuggle a different host\n\nA crafted git remote URL can no longer trick Claude Code into using the wrong repo identity.\n\n**What**\n\nBoth remote-URL matchers were narrowed so a crafted remote cannot make Claude Code derive the wrong `owner\/repo` identity. The host capture now excludes `\/` and `@`, and the userinfo capture excludes `@`, `\/`, `?` and `#`. Applies to everyone.\n\n**Details**\n\n- Covers the scp-style form (`git@host:owner\/repo.git`) and the URL-style form alike.\n\n**Evidence**\n\n`[^@\/?#]*@`, `\/^git@([^:\/@]+):(.+?)(?:\\.git)?$\/`\n\n- Area: Git Integration\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}