{"version":"2.1.199","anchor":"credential-masking-regex-extract-patterns","canonical_anchor":"credential-masking-regex-extract-patterns","heading":"Credential Masking: Regex Extract Patterns","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.199\/e\/credential-masking-regex-extract-patterns","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.199","markdown":"### Credential Masking: Regex Extract Patterns\n\nThe `credentials.files` sandbox setting now supports extracting and masking only specific values from a file rather than masking the entire file contents.\n\n**Details**\n\n- New `extract` field: a regex with a capture group 1 that identifies the credential value(s) within the file; the proxy substitutes only those captured values\n- New `onExtractNoMatch` option controls what happens when the pattern matches nothing:\n- `\"warn\"` (default) \u2014 logs a warning and leaves the file unprotected\n- `\"deny\"` \u2014 degrades to full-file deny mode (file is blocked from sandbox)\n- `\"error\"` \u2014 throws at initialization, preventing session start with a misconfigured entry\n- New `maskDuplicates` option: also masks occurrences of extracted values found elsewhere in the file outside the capture groups\n\nExample config:\n\n`{ \"credentials\": { \"files\": [{ \"path\": \"~\/.config\/tool\/credentials\", \"mode\": \"mask\", \"extract\": \"token=([A-Za-z0-9_-]+)\", \"onExtractNoMatch\": \"deny\", \"maskDuplicates\": true }] } }` **Evidence** (search for `\"onExtractNoMatch\"`, `\"extract pattern\"`, `\"maskDuplicates\"`)"}