{"version":"2.1.260","anchor":"credential-shaped-header-namesvalues-now-flagged-in-connect","canonical_anchor":"credential-shaped-header-namesvalues-now-flagged-in-connect","heading":"Credential-shaped header names\/values now flagged in connector\/hook config","tier":"notice","area":"Permissions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260\/e\/credential-shaped-header-namesvalues-now-flagged-in-connect","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.260","markdown":"### Credential-shaped header names\/values now flagged in connector\/hook config\n\nConnector\/hook config is now scanned for credential-shaped values and warns you to use a helper script.\n\nConnector and hook config is now scanned for credential-shaped header names (like `Authorization`, `Cookie`, or `X-API-Key`-style patterns) or values that look like bearer tokens, JWTs, AWS access keys, or common vendor secret formats (`sk-`, `ghp_`, `AIza`, `GOCSPX-`, `glpat-`, and others). When found, Claude Code warns you to use a headers\/credential helper script instead of storing the secret directly in the config file.\n\n- Area: Permissions\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 1\/5"}