You'll notice Notable
Connector/hook config is now scanned for credential-shaped values and warns you to use a helper script.
Connector and hook config is now scanned for credential-shaped header names (like Authorization, Cookie, or X-API-Key-style patterns) or values that look like bearer tokens, JWTs, AWS access keys, or common vendor secret formats (sk-, ghp_, AIza, GOCSPX-, glpat-, and others). When found, Claude Code warns you to use a headers/credential helper script instead of storing the secret directly in the config file.