sandbox.credentials — Credential protection in sandbox / Claude Code v2.1.187

What

A new credentials section in sandbox configuration lets you declare specific files and environment variables that must be protected when Claude runs sandboxed commands.

Usage

{
  "sandbox": {
    "credentials": {
      "files": [
        { "path": "~/.aws/credentials", "mode": "deny" },
        { "path": ".env", "mode": "deny" }
      ],
      "envVars": [
        { "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
        { "name": "GITHUB_TOKEN", "mode": "deny" }
      ]
    }
  }
}

Details

mode: "deny" on a file entry blocks reads inside the sandbox
mode: "deny" on an envVar entry unsets the variable for sandboxed commands
Only explicitly declared files and variables are restricted; everything else is unrestricted by default
Paths support the same resolution as other sandbox paths: absolute, ~-expanded, or relative to the settings file root
mode: "mask" is not yet supported — the sandbox will drop the credentials block and warn if an unsupported mode is specified
Works alongside existing filesystem.denyRead rules

Evidence

New schema and logic (search for "sandbox.credentials" or "Credential handling configuration")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.