{"version":"2.1.268","anchor":"git-url-validation-now-masks-credentials-in-error-messages","canonical_anchor":"git-url-validation-now-masks-credentials-in-error-messages","heading":"Git URL validation now masks credentials in error messages","tier":"notice","area":"Git Safety","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/git-url-validation-now-masks-credentials-in-error-messages","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Git URL validation now masks credentials in error messages\n\nGit URL validation now masks embedded credentials before showing an invalid-URL error, with clearer messages for wrong schemes\n\n**What**\n\nThe validator for SSH git URLs was reworked so that, when it rejects an invalid URL, it builds a masked copy of that URL before putting it in the error message: any embedded username\/password (userinfo) is replaced with `***`, and query or fragment content is replaced with `***`. Errors about a mismatched protocol now also distinguish between a scheme that's simply spelled wrong and other kinds of malformed input, with more specific messages for each.\n\n**Why**\n\nThis stops credentials that were accidentally embedded in a git URL from being echoed back in plain text inside an error message, while giving clearer feedback about why a URL was rejected.\n\n- Area: Git Safety\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}