{"version":"2.1.187","anchor":"sandbox-credentials-credential-protection-in-sandbox","canonical_anchor":"sandbox-credentials-credential-protection-in-sandbox","heading":"sandbox.credentials \u2014 Credential protection in sandbox","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.187\/e\/sandbox-credentials-credential-protection-in-sandbox","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.187","markdown":"### `sandbox.credentials` \u2014 Credential protection in sandbox\n\n**What**\n\nA new `credentials` section in sandbox configuration lets you declare specific files and environment variables that must be protected when Claude runs sandboxed commands.\n\n**Usage**\n\n`{ \"sandbox\": { \"credentials\": { \"files\": [ { \"path\": \"~\/.aws\/credentials\", \"mode\": \"deny\" }, { \"path\": \".env\", \"mode\": \"deny\" } ], \"envVars\": [ { \"name\": \"AWS_SECRET_ACCESS_KEY\", \"mode\": \"deny\" }, { \"name\": \"GITHUB_TOKEN\", \"mode\": \"deny\" } ] } } }` **Details** - `mode: \"deny\"` on a file entry blocks reads inside the sandbox - `mode: \"deny\"` on an envVar entry unsets the variable for sandboxed commands - Only explicitly declared files and variables are restricted; everything else is unrestricted by default - Paths support the same resolution as other sandbox paths: absolute, `~`-expanded, or relative to the settings file root - `mode: \"mask\"` is not yet supported \u2014 the sandbox will drop the credentials block and warn if an unsupported mode is specified - Works alongside existing `filesystem.denyRead` rules **Evidence** New schema and logic (search for `\"sandbox.credentials\"` or `\"Credential handling configuration\"`)"}