Starstruk Logo MarkStarstruk

v9.0.15

thedotmack/claude-memv9.0.15Feb 5, 2026by thedotmack

AI Summary

This is a security-focused patch release that hardens credential handling to prevent unintended API key usage from project directories. The update addresses a vulnerability where API keys could be accidentally hijacked from random project `.env` files.

Key Highlights

  • Prevents API key hijacking from random project `.env` files
  • Credentials now sourced exclusively from `~/.claude-mem/.env`
  • Only whitelisted environment variables passed to SDK `query()` calls
  • Authentication method logging shows whether using Claude Code CLI subscription billing or explicit API key

New Features

  • Authentication method logging to distinguish between Claude Code CLI subscription billing and explicit API key usage

Full Release Notes

## Security Fix

### Isolated Credentials (#745)
- **Prevents API key hijacking** from random project `.env` files
- Credentials now sourced exclusively from `~/.claude-mem/.env`
- Only whitelisted environment variables passed to SDK `query()` calls
- Authentication method logging shows whether using Claude Code CLI subscription billing or explicit API key

This is a security-focused patch release that hardens credential handling to prevent unintended API key usage from project directories.