You'll notice
Credential-file mask sweep now also runs on macOS in relaxed sandbox mode.
The credential-file mask-sweep eligibility check, previously limited to Linux and WSL, now also runs on macOS when the sandbox mode is set to relaxed, so masked credential files get swept for glob-pattern matches in that case too.