{"version":"2.1.251","anchor":"sandboxed-shells-get-a-masked-copy-of-the-environment","canonical_anchor":"sandboxed-shells-get-a-masked-copy-of-the-environment","heading":"Sandboxed shells get a masked copy of the environment","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/sandboxed-shells-get-a-masked-copy-of-the-environment","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Sandboxed shells get a masked copy of the environment\n\nSandboxed shells see a masked environment, so your credential variable names stay hidden.\n\n**What**\n\nWith credential env scrubbing on and sandboxing enabled, shell commands are now given a masked environment, and bash shells additionally get their env var names respelled. Sandboxed processes therefore cannot read the real names of your credential variables.\n\n**Details**\n\n- Requires both credential scrubbing and sandboxing to be active; with either off, the normal environment is used.\n- The name-respelling step applies to the bash shell path specifically.\n\n**Evidence**\n\n`sandboxMaskedEnv: Ee && R ? Ght().masked : void 0`\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 3\/5\n- Signal: 3\/5"}