{"version":"2.1.300","anchor":"urls-containing-credentials-are-no-longer-parsed-or-reported","canonical_anchor":"urls-containing-credentials-are-no-longer-parsed-or-reported","heading":"Web addresses that contain API keys are no longer read or reported","tier":"notice","area":"WebFetch","scope":"individual","heads_up":true,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/urls-containing-credentials-are-no-longer-parsed-or-reported","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Web addresses that contain API keys are no longer read or reported\n\nIf a web address contains something that looks like an API key, Claude Code now refuses to read it and reports no hostname\n\n**What**\n\nClaude Code now checks web addresses (URLs) for patterns that look like secret keys before reading them. It looks in the host name and in the user-and-password part of the address. It recognises keys from:\n\n- Anthropic\n\n- OpenAI\n\n- GitHub\n\n- Slack\n\n- Stripe\n\n- Google\n\n- signed tokens\n\nWhen one matches, Claude Code does not read the address and returns no hostname for it. Before, addresses were read without this check.\n\n**Why**\n\nIf you paste a key into a field that expects a web address, the key is no longer passed along in places where hostnames are logged.\n\n- Area: WebFetch\n- Tier: You'll notice\n- Useful: 1\/5\n- Signal: 1\/5\n- Scope: individual\n- Heads-up: yes"}