{"version":"2.1.268","anchor":"session-plugin-load-failure-messages-now-redact-url-credenti","canonical_anchor":"session-plugin-load-failure-messages-now-redact-url-credenti","heading":"Session-plugin load-failure messages now redact URL credentials, not just query strings","tier":"notice","area":"Plugins","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/session-plugin-load-failure-messages-now-redact-url-credenti","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Session-plugin load-failure messages now redact URL credentials, not just query strings\n\nPlugin load-failure error messages now mask credential-looking URL segments, not just query strings\n\n**What**\n\nWhen a plugin loaded from a URL fails to load, the resulting error message used to only strip out query strings from that URL before showing it. Now a new helper scans the whole message for embedded URLs and also masks any segment that looks like it contains login credentials (matching an `@` sign next to quote or bracket characters), in addition to still stripping query strings.\n\n**Why**\n\nThis reduces the chance that a plugin load-failure message accidentally displays a URL containing a username, password, or token.\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5"}