{"version":"2.1.224","anchor":"invalid-sandbox-credential-settings-now-fail-closed-instead-","canonical_anchor":"invalid-sandbox-credential-settings-now-fail-closed-instead-","heading":"Invalid sandbox credential settings now fail closed instead of being ignored","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/invalid-sandbox-credential-settings-now-fail-closed-instead-","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Invalid sandbox credential settings now fail closed instead of being ignored\n\nA malformed sandbox.credentials block now denies everything instead of quietly disabling protection.\n\n**What**\n\nA malformed `sandbox.credentials` block used to be dropped entirely, leaving no credential protection in place. It now degrades to a deny-everything skeleton: all sigv4 signing modes deny, and implicit AWS credential pairing is suppressed rather than left open.\n\n**Details**\n\n- Invalid awsPairs entries become non-functional suppressors built from the conventional AWS environment variable names, with a deterministic suffix so the result is stable across runs.\n- The sigv4 sub-keys streaming, presigned and sigv4a each degrade individually to \"deny\".\n- `allowPlaintextInject` degrades to an explicit false, so a lower-precedence settings file cannot turn it back on.\n- A single object where a list is expected is accepted as a one-element list with a warning.\n- A valid credentials block is salvaged out of an otherwise invalid `sandbox` value, with every other sandbox field ignored.\n\n**Evidence**\n\n`The credentials block was salvaged from the invalid sandbox value and stays enforced; every other sandbox field was ignored.`\n\n- Area: Sandbox\n- Names: `sandbox.credentials`\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 3\/5"}