You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Secret RedactionArea: what it touches
ImprovementsKind: in v2.1.290,
ImprovementsSection of the release
Unclear The new pattern is not shown, so it is not clear which tokens it now matches.
What
Redaction means replacing secret values with a placeholder so they do not appear in text Claude Code records. Two redaction rules changed:
URLs: Claude Code now finds login details in a URL written with brackets (@[) or with percent-encoding, which writes characters as % codes. It replaces them with [REDACTED]. Before, only the plain ://...@ form was caught.
JWTs: the rule for JSON Web Tokens, a common kind of login token, now uses a shared pattern. That pattern keeps some text in front of the token, so the replacement keeps that text and then adds [REDACTED-JWT].
Why
Passwords and tokens hidden inside URLs in the forms above are now replaced before they are recorded. The JWT change affects exactly which text around a token is kept and which is replaced.
How sure we are
Something disagreesSomething we can check disagrees with this entry, or the writer said they could not settle it.
The writer flagged doubtThe new pattern is not shown, so it is not clear which tokens it now matches.
