{"version":"2.1.208","anchor":"credential-masking-extract-patterns-with-onextractnomatch-co","canonical_anchor":"credential-masking-extract-patterns-with-onextractnomatch-co","heading":"Credential masking: extract patterns with onExtractNoMatch control","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.208\/e\/credential-masking-extract-patterns-with-onextractnomatch-co","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.208","markdown":"### Credential masking: extract patterns with onExtractNoMatch control\n\n**What**\n\nThe `credentials.envVars` credential masking feature now supports an `extract` regex pattern to pull a sub-token out of an environment variable's value before masking. A new `onExtractNoMatch` option controls what happens when the pattern doesn't match.\n\n**Details**\n\n- `extract`: a regex applied to the env var value; only the first capture group is masked\n- `onExtractNoMatch`:\n- `\"warn\"` (default): variable is left unprotected, a console warning is emitted\n- `\"deny\"`: variable is unset entirely from the sandbox environment\n- `\"error\"`: an error is thrown and the sandbox refuses to start\n- A runtime warning is logged when `\"warn\"` leaves a variable unprotected, making the risk visible in the log\n\n**Evidence**\n\nCredential extract pattern (search for `\"credentials.envVars entry\"` and `\"onExtractNoMatch\"`)"}