What probably matters to youSection of the release
What
The sandbox runtime's environment-variable and file credential-masking configuration gained new options:
decode: "jwt" – locates and verifies JWT (JSON Web Token)-shaped values and replaces them with a structurally valid fake token, swapping the real value back on the way out
maskClaims – masks only specific named claims inside a decoded JWT instead of masking the whole token value
maskDuplicates – also scrubs verbatim repeats of a captured secret that appear outside the original regex match
onExtractNoMatch – controls what happens when the configured extract regex doesn't match (warn, deny, or error), defaulting to warn
A separate schema addition also defines a MITM (man-in-the-middle) proxy configuration with socketPath and domains, to route matching traffic through the proxy, and an injectHosts option to narrow which hosts receive the real (unmasked) credential.
Why
Credentials are often embedded inside JWTs rather than being the whole value, so plain regex masking could miss or over-mask them. These additions let sandbox configurations mask JWT contents precisely, catch duplicate leaks, and control proxy routing more finely.
