{"version":"2.1.233","anchor":"file-sync-to-cloud-sessions-now-holds-back-credential-lookin","canonical_anchor":"file-sync-to-cloud-sessions-now-holds-back-credential-lookin","heading":"File sync to cloud sessions now holds back credential-looking files","tier":"notice","area":"Cloud Sessions","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233\/e\/file-sync-to-cloud-sessions-now-holds-back-credential-lookin","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.233","markdown":"### File sync to cloud sessions now holds back credential-looking files\n\nFiles that look like secrets, or that your Read rules deny, are held back from cloud sandboxes with a warning.\n\n**What**\n\nWhen files are carried to a remote sandbox, a new per-file check withholds anything that looks like a secret or that your own Read permission rules deny. You get a warning naming what was skipped and why.\n\n**Details**\n\n- Withheld by directory name: `.ssh`, `.aws`, `.azure`, `.gnupg`, `.kube`, `.docker`, and pairs such as `.config\/gh` and `.claude\/settings.local.json`.\n- Withheld by filename or extension: `.git-credentials`, `.npmrc`, `.pgpass`, `.zsh_history`, `secrets.yaml`, `_ed25519`, and `pem`, `p12`, `pfx`, `jks` keys and certs.\n- Also withholds files covered by your Read deny or ask rules.\n- Warnings end in \"not carried by file sync\" or \"not uploaded with this directory\", with reasons recorded as sensitive, read_denied or rules_unreadable.\n- If a settings file fails to parse, the message says your Read rules are unknown and points at `\/status`.\n- Telemetry gains `skipped_sensitive` and `skipped_read_denied` counts.\n- Only reached on the cloud and directory-sync path, so local sessions are unaffected.\n\n**Evidence**\n\n`a settings file has errors, so your Read rules are unknown (see \/status)`\n\n- Area: Cloud Sessions\n- Tier: You'll notice\n- Useful: 4\/5\n- Signal: 4\/5"}