Managed config URLs that look like they contain a key are refused
Claude Desktop managed settings now refuse a config URL whose host, user name or password looks like an API key or token, and list crash dumps as data sent
You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
Managed SettingsArea: what it touches
ImprovementsKind: in v2.1.300,
ImprovementsSection of the release
What
This affects administrators who set up Claude Desktop through managed configuration (settings pushed out by an organization). Config web addresses were already refused when they had credentials in the login part of the address. They are now also refused when the host name, user name or password looks like an API key or token, with a message saying it must not contain one.
The description of the "Essential" telemetry level (the basic usage and error data the app sends) in the desktop settings now lists crash dumps, described as unfiltered copies of part of the app's memory.
Why
Administrators are stopped from putting a secret into a config address by mistake, and can see that the Essential level includes crash dumps.
