{"version":"2.1.271","anchor":"environment-variable-passthrough-gets-an-explicit-allowlist","canonical_anchor":"environment-variable-passthrough-gets-an-explicit-allowlist","heading":"Environment variable passthrough gets an explicit allowlist","tier":"internal","area":"Elsewhere","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/environment-variable-passthrough-gets-an-explicit-allowlist","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### Environment variable passthrough gets an explicit allowlist\n\nEnvironment variables now pass through shell commands via an explicit allowlist instead of always merging with PATH\n\n**Unclear.** The finding does not say which variable names are in the allowlist beyond that they're uppercased.\n\n**What**\n\nWhen Claude Code builds the environment for running shell commands, it now checks a new allowlist of variable names first. If a variable's name is on this allowlist, its value is taken directly rather than being merged or split the way `PATH` normally is; names not on the allowlist still go through the previous merging logic.\n\n**Why**\n\nThis gives Claude Code more explicit control over which environment variables get special handling, rather than relying only on the general-purpose PATH-merging behavior for everything.\n\n- Area: Elsewhere\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}