You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
PermissionsArea: what it touches
ImprovementsKind: in v2.1.275,
ImprovementsSection of the release
What
A set of new URL-parsing checks now looks for tricks that can hide or spoof the real destination of a git or ssh URL, such as a percent-encoded '@' (%40), a backslash, or IPv6-bracket formatting used to disguise the host. These checks feed into two things: redacting any embedded credentials before a URL is shown, and deciding whether a URL should be trusted.
Why
Malicious repositories or links sometimes disguise a URL so it looks like it points to a trusted host when it actually points somewhere else, potentially exposing credentials. This hardens Claude Code against that kind of spoofing.
