What
Masked credential sentinels (set up via sandbox.credentials.envVars) are now replaced with their real values in outgoing request bodies as well as headers. A streaming Transform walks the body for sentinel byte sequences and swaps them in place.
Details
- Only applies to methods that send a body (
POST,PUT,PATCH, etc.) - Skipped for requests with
Content-Encodingheaders (compressed bodies cannot be substituted safely; a warning is logged) - If any sentinel differs in length from its real value, the
content-lengthheader is removed so the stream can change size - Only sentinels where sentinel length equals real-value length preserve
content-lengthintact
Evidence
Body substitution transform (search for "[body-substitution]" or "substitution skipped — a sentinel in this body").
Strings lifted out of the shipped bundle, so the claim above can be checked against them.