3 pages for credentials.envvars.
Titles and paths first, then pages whose text carries it. Each row opens that page as this site last read it.
Configure the sandboxed Bash tool
Claude Code CLI · in the page
sandboxing
…y` read blocks | Not enforced. The filesystem layer applies both | | `credentials.envVars` `deny` and `mask` entries | Enforced. Environment variable scrubbing is independent of the filesystem layer |…
Claude Code settings
Claude Code CLI · in the page
settings
…bstitutes the real value of a file `mask` entry. Behaves the same as `credentials.envVars[].injectHosts`. When unset, the proxy substitutes the value on requests to every host in `network.allowedDomai…
All settings
Claude Code CLI · in the page
settings-reference
…sign-aws-requests) | Sandbox settings | User or managed | | [`sandbox.credentials.envVars`](#sandbox-credentials-envvars) | Unset or mask an environment variable inside the [sandbox](/docs/en/sandboxi…