What
A new credentials section in sandbox configuration lets you declare specific files and environment variables that must be protected when Claude runs sandboxed commands.
Usage
{
"sandbox": {
"credentials": {
"files": [
{ "path": "~/.aws/credentials", "mode": "deny" },
{ "path": ".env", "mode": "deny" }
],
"envVars": [
{ "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
{ "name": "GITHUB_TOKEN", "mode": "deny" }
]
}
}
}Details
mode: "deny"on a file entry blocks reads inside the sandboxmode: "deny"on an envVar entry unsets the variable for sandboxed commands- Only explicitly declared files and variables are restricted; everything else is unrestricted by default
- Paths support the same resolution as other sandbox paths: absolute,
~-expanded, or relative to the settings file root mode: "mask"is not yet supported — the sandbox will drop the credentials block and warn if an unsupported mode is specified- Works alongside existing
filesystem.denyReadrules
Evidence
New schema and logic (search for "sandbox.credentials" or "Credential handling configuration")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agree
Added sandbox.credentials setting to block sandboxed commands from reading credential files and secret environment variables