{"version":"2.1.251","anchor":"large-list-of-credential-file-environment-variables-near-san","canonical_anchor":"large-list-of-credential-file-environment-variables-near-san","heading":"Large list of credential-file environment variables near sandbox scoping","tier":"internal","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/large-list-of-credential-file-environment-variables-near-san","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Large list of credential-file environment variables near sandbox scoping\n\nA long list of credential-file environment variables now sits near sandbox scoping code.\n\n**What**\n\nA new list names environment variables that point at credential and config files: AWS, Azure, GCP, Kubernetes, Docker, git, pip, Postgres, Vault, Consul, Nomad, Terraform, gpg, npm and gh, plus `CLAUDE_ENV_FILE`, `CLAUDE_CODE_FEDERATION_CACHE_DIR` and `ANTHROPIC_IDENTITY_TOKEN_FILE`.\n\n**Details**\n\n- It sits beside the existing proxy environment and temp-directory allowlists in the sandbox permission-scoping code, which suggests it decides which credential paths get special treatment under sandboxed execution.\n- No function in this build reads the list, so nothing acts on it yet.\n\n**Evidence**\n\n`CLOUDSDK_AUTH_ACCESS_TOKEN_FILE`\n\n- Area: Sandbox\n- Names: `CLAUDE_ENV_FILE`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 4\/5"}