You'll noticeTier: how much it should matter to you
1Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
WebFetchArea: what it touches
ImprovementsKind: in v2.1.300,
ImprovementsSection of the release
What
Claude Code now checks web addresses (URLs) for patterns that look like secret keys before reading them. It looks in the host name and in the user-and-password part of the address. It recognises keys from:
Anthropic
OpenAI
GitHub
Slack
Stripe
Google
signed tokens
When one matches, Claude Code does not read the address and returns no hostname for it. Before, addresses were read without this check.
Why
If you paste a key into a field that expects a web address, the key is no longer passed along in places where hostnames are logged.
