{"version":"2.1.221","anchor":"sandbox-credential-masking-documents-its-platform-limits","canonical_anchor":"sandbox-credential-masking-documents-its-platform-limits","heading":"Sandbox credential masking documents its platform limits","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/sandbox-credential-masking-documents-its-platform-limits","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Sandbox credential masking documents its platform limits\n\nSandbox credential masking now documents that it falls back to deny on macOS and Windows.\n\n**What**\n\nThe settings schema description for sandbox credential files now explains what `mask` actually does and where it does not work.\n\n**Details**\n\n- `mask` shows sandboxed commands a sentinel-substituted copy of the file, either the whole file or only the spans captured by `extract`.\n- The proxy swaps the real value back in on egress.\n- The description now states outright that the mode degrades to `deny` on macOS and Windows.\n\n**Evidence**\n\n`On macOS and Windows `mask` degrades to `deny`.`\n\n- Area: Sandbox\n- Names: `mask`, `deny`, `extract`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 0\/5"}