Under the hood
New helper functions strip credentials, query strings, and fragments from URLs before they're logged
What
Claude Code now has a set of internal helper functions that detect and remove sensitive parts of a URL, such as an embedded username and password (user:pass@host), query strings, and fragments, as well as sensitive parts of Windows/UNC file paths. When found, these are replaced with a fixed placeholder, [redacted URL], before the URL is written to logs or telemetry.
Why
This reduces the chance that credentials or other sensitive data embedded in a URL or file path accidentally end up in logs or diagnostic data.