{"version":"2.1.235","anchor":"policy-helper-subprocess-environment-scrubbing-moved-and-har","canonical_anchor":"policy-helper-subprocess-environment-scrubbing-moved-and-har","heading":"Policy-helper subprocess environment scrubbing moved and hardened","tier":"internal","area":"Policy Helpers","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235\/e\/policy-helper-subprocess-environment-scrubbing-moved-and-har","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.235","markdown":"### Policy-helper subprocess environment scrubbing moved and hardened\n\nPolicy-helper environment scrubbing moved into its own module and now strips more variables\n\nThe list of credential-bearing environment variables removed before running a policy helper (`ANTHROPIC_API_KEY`, `AWS_SECRET_ACCESS_KEY`, `GOOGLE_APPLICATION_CREDENTIALS`, and others matched by a TOKEN\/SECRET\/PASSWORD-style pattern) has moved out of its previous module into a dedicated one. The sanitizer built around it now also drops loader and interpreter hijack variables like `LD_`, `DYLD_`, `NODE_OPTIONS`, `BASH_ENV`, `CLASSPATH`, and `OPENSSL_CONF`, and pins `PATH`, `COMSPEC`, `ZDOTDIR`, `XDG_CONFIG_HOME`, and git config paths to an empty directory.\n\n- Area: Policy Helpers\n- Tier: Under the hood\n- Useful: 1\/5\n- Signal: 1\/5"}