Claude Code Now Requires Approval for Settings That Terminate Sandbox TLS or Inject Credential Headers

Claude Code Changelog·high signalXBlueskyLinkedInCopy link

2.1.251 changes server-managed settings that terminate sandbox TLS, route sandbox traffic through your own proxy, inject credentials, or weaken sandbox isolation to require approval before they apply, and `ANTHROPIC_CUSTOM_HEADERS` from managed or project settings now needs approval when it sets a credential, org/tenant, routing, or API-behavior header such as `Authorization` or `Host`. Separately, project-level `.claude/settings.json` `env` can no longer set `CLAUDE_CONFIG_DIR`, `CLAUDE_CODE_TMPDIR`, or `TMPDIR`/`TMP`/`TEMP`. The through-line is that a checked-in project settings file was a config-injection vector, and it is now scoped down.