{"version":"2.1.221","anchor":"sandbox-filesystem-disabled-description-corrected-on-credent","canonical_anchor":"sandbox-filesystem-disabled-description-corrected-on-credent","heading":"Sandbox filesystem.disabled description corrected on credential masks","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221\/e\/sandbox-filesystem-disabled-description-corrected-on-credent","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.221","markdown":"### Sandbox filesystem.disabled description corrected on credential masks\n\nSettings docs now explain that masked credential files survive a relaxed sandbox filesystem policy while denied ones do not.\n\n**What**\n\nThe settings schema text for skipping filesystem isolation now separates two kinds of credentials.files entries that behave differently under a relaxed filesystem policy.\n\n**Details**\n\n- Deny entries in credentials.files are dropped and pin the setting to managed settings.\n- Mask entries are implemented as sentinel binds, survive the relaxed filesystem policy, and do not pin the setting.\n- Env scrubbing is likewise independent of the filesystem policy.\n\n**Evidence**\n\n`do not pin it \u2014 env scrubbing and sentinel binds are independent of the filesystem `\n\n- Area: Sandbox\n- Names: `filesystem.disabled`, `credentials.files`\n- Tier: Use it now\n- Useful: 3\/5\n- Signal: 0\/5"}