Vibe Coding
Claude Code 2.1.251 stops project settings from turning on raw API body logging
A quieter security bullet in the same release: project settings could previously enable detailed beta tracing or raw API body logging, and a lower-scope beta tracing endpoint could bypass an OTLP collector pinned by managed settings or a host app. Separately, project-level `.claude/settings.json` `env` can no longer set `CLAUDE_CONFIG_DIR`, `CLAUDE_CODE_TMPDIR`, or `TMPDIR`/`TMP`/`TEMP`; those now have to come from your shell, user, or managed settings. Both close the same shape of hole, a checked-in repo file redirecting where your session's secrets and scratch files go.
↳ Follow the thread