{"version":"2.1.224","anchor":"stricter-cleanup-of-jwt-masking-rules","canonical_anchor":"stricter-cleanup-of-jwt-masking-rules","heading":"Stricter cleanup of JWT masking rules","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224\/e\/stricter-cleanup-of-jwt-masking-rules","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.224","markdown":"### Stricter cleanup of JWT masking rules\n\nMalformed JWT masking options in credential rules are now discarded.\n\n**What**\n\nDeny-mode credential masking rules now discard a `decode` value that is not `\"jwt\"`, and discard `maskClaims` unless it is an array of strings, on top of the existing cleanup of the extract, no-match and duplicate-masking options.\n\n**Evidence**\n\n`maskClaims requires decode \\u2014 without a decode format there is no token to read claims from. Set decode, or omit maskClaims.`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 2\/5"}