What's wrong with this entry?
Anonymous. No account, no email.
What
Masked credential sentinels (set up via sandbox.credentials.envVars) are now replaced with their real values in outgoing request bodies as well as headers. A streaming Transform walks the body for sentinel byte sequences and swaps them in place.
Details
- Only applies to methods that send a body (
POST,PUT,PATCH, etc.) - Skipped for requests with
Content-Encodingheaders (compressed bodies cannot be substituted safely; a warning is logged) - If any sentinel differs in length from its real value, the
content-lengthheader is removed so the stream can change size - Only sentinels where sentinel length equals real-value length preserve
content-lengthintact
Evidence
Body substitution transform (search for "[body-substitution]" or "substitution skipped — a sentinel in this body").
Strings lifted out of the shipped bundle, so the claim above can be checked against them.