What's wrong with this entry?
Anonymous. No account, no email.
What
The sandbox.credentials.envVars config now supports decode: "jwt" to handle JWT tokens: the token is replaced with a structurally valid but fake JWT inside the sandbox, with real claim values masked as sentinels injected into requests.
Details
- Add
decode: "jwt"to acredentials.envVarsentry to activate JWT handling - Optional
maskClaims: ["sub", "email"]masks specific string claims within the JWT, replacing each with a per-claim sentinel injected at the network layer - If the environment variable is not a valid JWT, the variable is left unprotected and a warning is logged
- If
maskClaimsnames a claim that is absent or not a string, that claim is skipped and logged - Replaces the previous
extract-regex-only approach, which remains available for non-JWT values
Evidence
JWT masking handler (search for "decode \"jwt\"" or "maskClaims"). Fake token generator (search for "pnu = \"c3J0LWZha2U\"" which is the fake signature base64).
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.