What
The credentials.envVars credential masking feature now supports an extract regex pattern to pull a sub-token out of an environment variable's value before masking. A new onExtractNoMatch option controls what happens when the pattern doesn't match.
Details
extract: a regex applied to the env var value; only the first capture group is maskedonExtractNoMatch:"warn"(default): variable is left unprotected, a console warning is emitted"deny": variable is unset entirely from the sandbox environment"error": an error is thrown and the sandbox refuses to start- A runtime warning is logged when
"warn"leaves a variable unprotected, making the risk visible in the log
Evidence
Credential extract pattern (search for "credentials.envVars entry" and "onExtractNoMatch")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.