{"name":"sandbox.credentials.files","slug":"sandbox-credentials-files","family":"setting","title":"Settings keys","noun":"settings key","description":"Block or mask reads of a credential file inside the [sandbox](\/docs\/en\/sandboxing#mask-credential-files)","description_source":"docs","described_by":{"doc":"claude-code\/settings-reference","title":"All settings"},"presence":{"first_seen":null,"removed_in":null,"in_current_build":false,"newest_mined":"2.1.308","builds":0,"mined_builds":149,"first_cited":{"version":"2.1.301","released_at":"2026-10-15 14:34:23","spans":1}},"aliases":[],"entries":[{"version":"2.1.301","anchor":"settings-validation-sandboxcredentials-warnings-now-handle","heading":"Sandbox credential settings errors are now checked separately","line":"Problems in sandbox and sandbox.credentials settings, including warnings, are now judged by their own check for whether they stop settings from loading","released_at":"2026-10-15 14:34:23","reason":"found in this entry's text"},{"version":"2.1.221","anchor":"sandbox-credentials-files-gains-a-mask-mode-with-regex-extra","heading":"sandbox.credentials.files gains a mask mode with regex extraction","line":"You can mask secrets in credential files so sandboxed commands see placeholders while real values are swapped in on egress.","released_at":"2026-08-03 22:16:25","reason":"named in this entry, found in this entry's text"}],"entries_total":2,"docs":[{"source":"claude-code","path":"settings-reference","title":"All settings","documented":true},{"source":"claude-code","path":"changelog","title":"Claude Code changelog","documented":false},{"source":"claude-code","path":"sandboxing","title":"Configure the sandboxed Bash tool","documented":false}],"docs_total":3,"gates":[],"related":[{"name":"sandbox.credentials","slug":"sandbox-credentials","description":"Hide or mask credential files and variables inside the [sandbox](\/docs\/en\/sandboxing#protect-credentials)"},{"name":"sandbox.credentials.awsPairs","slug":"sandbox-credentials-awspairs","description":"Link custom-named AWS key variables into one credential for [re-signing](\/docs\/en\/sandboxing#re-sign-aws-requests)"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/sandbox-credentials-files","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}