{"version":"2.1.257","anchor":"hook-env-var-interpolation-now-blocks-credential-looking-val","canonical_anchor":"hook-env-var-interpolation-now-blocks-credential-looking-val","heading":"Hook env var interpolation now blocks credential-looking values from HTTP headers","tier":"notice","area":"Hooks","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257\/e\/hook-env-var-interpolation-now-blocks-credential-looking-val","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.257","markdown":"### Hook env var interpolation now blocks credential-looking values from HTTP headers\n\nA variable whose value looks like a credential is now refused when interpolating into HTTP hook headers.\n\nWhen interpolating `${VAR}` into HTTP hook headers, the CLI now checks whether the variable's value looks like a credential using a heuristic. If it does, interpolation is refused and a warning is logged, even if the variable is listed in `allowedEnvVars`, unless it's separately allow-listed.\n\n- Area: Hooks\n- Names: `allowedEnvVars`\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}