Connector and hook config is now scanned for credential-shaped header names (like Authorization, Cookie, or X-API-Key-style patterns) or values that look like bearer tokens, JWTs, AWS access keys, or common vendor secret formats (sk-, ghp_, AIza, GOCSPX-, glpat-, and others). When found, Claude Code warns you to use a headers/credential helper script instead of storing the secret directly in the config file.
Credential-shaped header names/values now flagged in connector/hook config
Connector/hook config is now scanned for credential-shaped values and warns you to use a helper script.
You'll noticeTier: how much it should matter to you
3Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.260,
What probably matters to youSection of the release