{"version":"2.1.251","anchor":"work-secret-parsing-rejects-certificate-and-executable-crede","canonical_anchor":"work-secret-parsing-rejects-certificate-and-executable-crede","heading":"Work secret parsing rejects certificate and executable credential sources","tier":"internal","area":"Credentials","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251\/e\/work-secret-parsing-rejects-certificate-and-executable-crede","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.251","markdown":"### Work secret parsing rejects certificate and executable credential sources\n\nSession credentials backed by certificates or executables are now refused with named reasons.\n\n**What**\n\nThe credential payload used to start a session is now validated more strictly. It follows a bounded chain of nested credential sources and refuses X.509 certificate and executable-backed sources outright, with named failure reasons instead of generic errors. Always on.\n\n**Details**\n\n- Named verdicts: secret_did_not_decode, unsupported_version, missing_session_ingress_token, missing_api_base_url.\n- Failures now carry a dedicated shape-error type rather than an untyped throw.\n\n**Evidence**\n\n`an X.509 certificate credential source cannot be excluded from the shell`\n\n- Area: Credentials\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 3\/5"}