Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.234 Home All releases ←olderv2.1.233 v2.1.235newer→
Claude Code v2.1.234

Slack workflow tokens and webhook URLs are scrubbed

You'll notice
Useful3 Signal2
Secret Redaction

Slack workflow tokens and webhook URLs are now scrubbed from text before it leaves your machine.

What

The credential scrubber applied to text before it leaves the client now catches Slack workflow tokens beginning xwfp- and Slack webhook URLs under hooks.slack.com/services, /workflows and /triggers, replacing them with a placeholder instead of letting them through.

Details
  • Tokens are replaced with [REDACTED-PAT]; webhook URLs are replaced with their own placeholder.
  • Both patterns were added to every scrubber in the build, including the token table that already handled bearer and Basic headers, sk-ant- keys, GitHub and GitLab tokens and Slack xoxb- tokens.
Evidence

hooks.slack.com/<redacted>, [REDACTED-PAT]

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

Related

Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.

See this entry in the whole of v2.1.234 →