{"version":"2.1.238","anchor":"bridge-spawned-sessions-start-with-credentials-stripped-from","canonical_anchor":"bridge-spawned-sessions-start-with-credentials-stripped-from","heading":"Bridge-spawned sessions start with credentials stripped from their environment","tier":"internal","area":"Remote Control","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238\/e\/bridge-spawned-sessions-start-with-credentials-stripped-from","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.238","markdown":"### Bridge-spawned sessions start with credentials stripped from their environment\n\nBridge-spawned child sessions no longer inherit your credential environment variables.\n\n**What**\n\nChild processes started by the bridge now inherit an explicit allowlist of environment variables plus an explicit clear-list, and several credential carriers that used to be passed through are unset: OAuth and API-key file descriptors, the background auth snapshot path (`CLAUDE_BG_AUTH_SNAPSHOT_PATH`), account, org and email identifiers, the session ingress URL and the exit-after-stop delay.\n\n**Details**\n\n- Lowercase duplicates of every cleared name are deleted too, so a lowercase shadow cannot smuggle a value through.\n- Unconditional for bridge-spawned sessions.\n\n**Evidence**\n\n`CLAUDE_BG_AUTH_SNAPSHOT_PATH`\n\n- Area: Remote Control\n- Names: `CLAUDE_BG_AUTH_SNAPSHOT_PATH`\n- Tier: Under the hood\n- Useful: 3\/5\n- Signal: 3\/5"}