Under the hoodTier: how much it should matter to you
3Useful: my rating, 1 to 5
4Signal: worth watching, 1 to 5
Shell ExecutionArea: what it touches
Internal ChangesKind: in v2.1.227,
What probably matters to youSection of the release
What
The command builder gained an option that skips injecting the usual credential exports and instead appends a scrubbing step before the command runs. At least one internal caller uses it alongside sandboxing and cwd-change prevention. There is no user-facing setting for it.
Evidence
scrubCredentialEnv
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
