{"version":"2.1.274","anchor":"file-publish-source-verification-hardened-against-symlinkha","canonical_anchor":"file-publish-source-verification-hardened-against-symlinkha","heading":"File-publish source verification hardened against symlink\/hardlink spoofing, with an explicit refusal path","tier":"notice","area":"Artifacts","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274\/e\/file-publish-source-verification-hardened-against-symlinkha","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.274","markdown":"### File-publish source verification hardened against symlink\/hardlink spoofing, with an explicit refusal path\n\nFile-publish source verification now has a dedicated refusal for files it can't safely confirm, guarding against symlink spoofing\n\n**What**\n\nBefore publishing a staged file, Claude Code verifies that the source file is what it appears to be. This check now uses a dedicated refusal response when a file's path can't be safely verified, for example because a symbolic or hard link makes the true source unclear. Previously this case was handled by a separate, duplicated deny object.\n\n**Why**\n\nThis hardens the publish path against symlink or hardlink tricks that could otherwise be used to substitute a different file than the one that was actually staged.\n\n- Area: Artifacts\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}