{"version":"2.1.79","anchor":"subprocess-environment-scrubbing","canonical_anchor":"subprocess-environment-scrubbing","heading":"Subprocess Environment Scrubbing","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.79\/e\/subprocess-environment-scrubbing","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.79","markdown":"### Subprocess Environment Scrubbing\n\n**What**\n\nA new `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB` environment variable that, when enabled, strips sensitive credentials from the environment passed to subprocesses (like Bash tool invocations).\n\n**Usage**\n\n`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 claude` **Details** - Removes API keys, OAuth tokens, and other secrets from subprocess environments - Scrubbed variables include: `ANTHROPIC_API_KEY`, `AWS_SECRET_ACCESS_KEY`, `AWS_SESSION_TOKEN`, `GOOGLE_APPLICATION_CREDENTIALS`, `AZURE_CLIENT_SECRET`, GitHub Actions tokens, and more - Also scrubs `INPUT_` prefixed variants of all listed variables **Evidence** Environment scrubbing for subprocess execution (search for `\"CLAUDE_CODE_SUBPROCESS_ENV_SCRUB\"`)"}