What probably matters to youSection of the release
What
The settings schema text for skipping filesystem isolation now separates two kinds of credentials.files entries that behave differently under a relaxed filesystem policy.
Details
Deny entries in credentials.files are dropped and pin the setting to managed settings.
Mask entries are implemented as sentinel binds, survive the relaxed filesystem policy, and do not pin the setting.
Env scrubbing is likewise independent of the filesystem policy.
Evidence
do not pin it — env scrubbing and sentinel binds are independent of the filesystem
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
