You'll notice
Claude Code now detects hidden or spoofed hosts in git/ssh/http(s) URLs and redacts credentials from them
What
A set of new URL-parsing checks now looks for tricks that can hide or spoof the real destination of a git or ssh URL, such as a percent-encoded '@' (%40), a backslash, or IPv6-bracket formatting used to disguise the host. These checks feed into two things: redacting any embedded credentials before a URL is shown, and deciding whether a URL should be trusted.
Why
Malicious repositories or links sometimes disguise a URL so it looks like it points to a trusted host when it actually points somewhere else, potentially exposing credentials. This hardens Claude Code against that kind of spoofing.