{"version":"2.1.321","anchor":"managed-marketplace-pinning-checks-and-secret-scanner-prefil","canonical_anchor":"managed-marketplace-pinning-checks-and-secret-scanner-prefil","heading":"Stricter checks on plugin marketplaces set by an organization's managed settings","tier":"notice","area":"Plugins","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/managed-marketplace-pinning-checks-and-secret-scanner-prefil","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Stricter checks on plugin marketplaces set by an organization's managed settings\n\nClaude Code warns when managed settings give a plugin marketplace a non-absolute path, and now compares pins for marketplaces that come from settings\n\n**Unclear.** What Claude Code does with the new list of sensitive file names is not shown.\n\n**What**\n\nManaged settings are settings an administrator sets for everyone in an organization. A plugin marketplace is a source Claude Code installs plugins from. Several checks were added:\n\n- Path warning: Claude Code warns when managed settings place a marketplace at a path that is not absolute, meaning not written out in full from the top of the file system.\n\n- Pins: for marketplaces that come from settings, Claude Code now compares their pins, the fixed point a marketplace is locked to.\n\n- Sensitive file names: Claude Code now carries a long list of file names it treats as sensitive.\n\n- Secret scanning: every rule Claude Code uses to look for passwords and keys in text now has a short piece of text that must be present before the full rule is tried.\n\n**Why**\n\nOrganizations get marketplace policy enforced more strictly, and the search for leaked secrets runs faster.\n\n- Area: Plugins\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5\n- Scope: org\n- Heads-up: no"}