{"version":"2.1.248","anchor":"lists-of-sensitive-config-and-credential-paths","canonical_anchor":"lists-of-sensitive-config-and-credential-paths","heading":"Lists of sensitive config and credential paths","tier":"internal","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248\/e\/lists-of-sensitive-config-and-credential-paths","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.248","markdown":"### Lists of sensitive config and credential paths\n\nNew lists name sensitive config and credential files like .npmrc and .claude.json.\n\n**What**\n\nNew lists name config files treated specially, including `.npmrc`, `.envrc`, `.mcp.json`, `.claude.json` and `.pre-commit-config.yaml`, along with credential directory paths such as `.config\/gh` and `.claude\/settings.local.json`. Which file-access guard reads these lists is not decided in the same code, so no behaviour change is visible from them alone.\n\n**Evidence**\n\n`.pre-commit-config.yaml`\n\n- Area: Permissions\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5\n- Present in the build but not switched on"}