You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
2Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.224,
ImprovementsSection of the release
What
Deny-mode credential masking rules now discard a decode value that is not "jwt", and discard maskClaims unless it is an array of strings, on top of the existing cleanup of the extract, no-match and duplicate-masking options.
Evidence
maskClaims requires decode \u2014 without a decode format there is no token to read claims from. Set decode, or omit maskClaims.
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
How sure we are
One source agreesOne thing we can check says the same as this entry.
Anthropic's release notes agreeAdded sandbox credential-masking options: extract and onExtractNoMatch for structured env values, decode: "jwt" with maskClaims for…
