{"version":"2.1.292","anchor":"object-key-sanitiser-now-drops-proto-keys","canonical_anchor":"object-key-sanitiser-now-drops-proto-keys","heading":"Object copying now drops any key named __proto__","tier":"internal","area":"Internal Helpers","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.292\/e\/object-key-sanitiser-now-drops-proto-keys","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.292","markdown":"### Object copying now drops any key named __proto__\n\nA routine that copies data key by key now skips any key named __proto__, which closes off a known kind of attack\n\n**What**\n\nClaude Code has a routine that copies data key by key, going into nested data too. Before, it copied every key. It now skips any key named `__proto__`.\n\n**Why**\n\nIn JavaScript, `__proto__` is a special name. Data that contains it can change how every object in a program behaves, a problem known as prototype pollution. Dropping the key closes that route.\n\n- Area: Internal Helpers\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 0\/5\n- Scope: individual\n- Heads-up: no"}