{"version":"2.1.268","anchor":"sandbox-schema-additions-mitm-proxy-domain-routing-and-env","canonical_anchor":"sandbox-runtime-credential-masking-gains-jwt-decoding-claim","heading":"Sandbox credential masking gains JWT-aware decoding and claim-level control","tier":"use","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268\/e\/sandbox-schema-additions-mitm-proxy-domain-routing-and-env","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.268","markdown":"### Sandbox credential masking gains JWT-aware decoding and claim-level control\n\nSandbox credential masking can now decode JWTs, mask only specific claims inside them, and scrub duplicate secret values\n\n**What**\n\nThe sandbox runtime's environment-variable and file credential-masking configuration gained new options:\n\n- `decode: \"jwt\"` \u2013 locates and verifies JWT (JSON Web Token)-shaped values and replaces them with a structurally valid fake token, swapping the real value back on the way out\n\n- `maskClaims` \u2013 masks only specific named claims inside a decoded JWT instead of masking the whole token value\n\n- `maskDuplicates` \u2013 also scrubs verbatim repeats of a captured secret that appear outside the original regex match\n\n- `onExtractNoMatch` \u2013 controls what happens when the configured `extract` regex doesn't match (`warn`, `deny`, or `error`), defaulting to `warn`\n\nA separate schema addition also defines a MITM (man-in-the-middle) proxy configuration with `socketPath` and `domains`, to route matching traffic through the proxy, and an `injectHosts` option to narrow which hosts receive the real (unmasked) credential.\n\n**Why**\n\nCredentials are often embedded inside JWTs rather than being the whole value, so plain regex masking could miss or over-mask them. These additions let sandbox configurations mask JWT contents precisely, catch duplicate leaks, and control proxy routing more finely.\n\n- Area: Sandbox\n- Names: `socketPath`\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 4\/5\n- Present in the build but not switched on"}