What
Some web addresses carry a username and password before the host, for example https://user:pass@host. When Claude Code writes logs, it now masks that part as ***:***@, and also removes any further @-separated pieces that follow it. That way a password containing an @ cannot leave part of itself behind.
Why
This keeps credentials that appear in URLs from leaking into log files.