{"version":"2.1.235","anchor":"slash-command-arguments-and-untrusted-display-names-are-reda","canonical_anchor":"slash-command-arguments-and-untrusted-display-names-are-reda","heading":"Slash-command arguments and untrusted display names are redacted\/sanitized before display","tier":"notice","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235\/e\/slash-command-arguments-and-untrusted-display-names-are-reda","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235","markdown":"### Slash-command arguments and untrusted display names are redacted\/sanitized before display\n\nSlash-command args and untrusted display names are now redacted or sanitized before appearing in the transcript\n\nCommand echoing into the transcript now passes arguments through the secret-redaction pass (Bearer tokens, Basic auth, `sk-ant-` keys, Slack webhook URLs) for both the echoed `\/command args` line and the \"Args from unknown skill\" warning; an unknown command whose args change under redaction is now treated as sensitive. Separately, plugin names, granted-scope display names, added workspace directory paths, and the IDE name shown in \"Opened changes in \u2026\" are now run through a display sanitizer that blanks strings with zero visible width.\n\n- Area: Elsewhere\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}