Claude Code v2.1.248 was published at 22:12:20 UTC on 27 August. Among roughly forty changelog entries sits this one, verbatim: "Fixed /ultrareview and locally seeded cloud sessions uploading uncommitted prod.env-style and *.tfvars files, or to editor swap, temp, and backup copies of credential files (e.g. key.pem.tmp, id_rsa.swo); they now stay on your machine."
What those filenames are
An uncommitted prod.env is production credentials. A .tfvars file is Terraform variables — commonly cloud access keys and infrastructure secrets. id_rsa.swo is a Vim swap file for a private SSH key. These are not incidental artefacts; they are the specific files a developer keeps out of version control precisely because they are secrets.
The other headline entry
The same release adds --restricted (or CLAUDE_CODE_RESTRICTED=1), which "removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files." Also in 2.1.248: cross-session messaging extended to Bedrock, Vertex and Foundry, a Workflow tool description cut from about 5.7k tokens to 1k, and a fix for a prompt-cache miss occurring "roughly once an hour in long sessions" after an OAuth token refresh.
What the common framing gets wrong
The framing problem is the absence of framing. A secrets-exfiltration fix was published as an unnumbered bullet — no security advisory, no GHSA identifier, no CVE, no "action required" notice, no disclosed introduction date and no affected-version range. Affected users have no way to determine whether their keys left the machine, or for how long.
Second, the .swo and .tmp detail identifies the bug class: the uploader filtered canonical credential filenames but not the editor-generated variants sitting beside them. That is a denylist failure, which is a design-class problem, reported here as a one-off fix.
Third, --restricted is a hardening flag, not a sandbox. Read the wording: it removes tools and ignores settings files. That is in-process capability reduction, not an operating-system boundary — and the name invites readers to assume containment. It also silently ignores user, project and local settings, a behaviour change that will surprise anyone enabling it expecting only tool removal.
Finally, cadence obscures severity: at three releases in 26 hours, with 2.1.250 labelled only "Bug fixes and reliability improvements," a security-relevant fix is indistinguishable from routine churn.