benchkeeper 6.20

• App, two security controls in the Claude Code settings catalog (#313, ranks 5 and 6 of the control candidates in docs/security.md, part of #272): env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB (strips credentials from the environments of Bash commands, hooks and stdio MCP servers; GitHub tokens and proxy settings stay) and permissions.deny, each with its documentation link and a one-line reason. doctor warns while the scrub is not on (1, taking the value of the highest settings layer, else the process environment) and while no Read deny rule that reaches a home folder (the home anchor, //**/ or an absolute home path) covers each of the .ssh, .aws and .config/gh folders; it skips both warnings while a settings file cannot be read. benchkeeper settings set env.CLAUDE_CODE_SUBPROCESS_ENV_SCRUB 1 turns the scrub on. Setup writes neither: a subprocess that needs a removed variable would break, and the deny rules merge into a list the user may already have. A deny rule does not cover a script that opens the files itself. Existing catalog entries are unchanged.
• Plugin version 6.20.0.
• Upgrade: npx benchkeeper@6.20.0 apply.