You'll notice
A variable whose value looks like a credential is now refused when interpolating into HTTP hook headers.
When interpolating ${VAR} into HTTP hook headers, the CLI now checks whether the variable's value looks like a credential using a heuristic. If it does, interpolation is refused and a warning is logged, even if the variable is listed in allowedEnvVars, unless it's separately allow-listed.
Names in the bundleallowedEnvVars
Documented inclaude-code/hooks