Under the hood
Useful3 Signal4
Shell commands can run with credentials stripped from the environment, but there's no setting for it.
What's wrong with this entry?
Anonymous. No account, no email.
What
The command builder gained an option that skips injecting the usual credential exports and instead appends a scrubbing step before the command runs. At least one internal caller uses it alongside sandboxing and cwd-change prevention. There is no user-facing setting for it.
Evidence
scrubCredentialEnv
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Related
Other releases about the same thing. Found by shared names or similar wording; neither means one caused the other.
-
v2.1.234
A failed write to a subprocess's stdin no longer looks like success
Both mention shell execution
-
v2.1.234
Subprocess stdin errors surface rather than silently truncating output
Both mention shell execution
-
v2.1.239
Remote tool execution is complete but hard-disabled in this build
Both mention execution