You'll notice
Sandbox credential protection logic rewritten with clearer warning messages
What
The part of Claude Code's sandbox (a restricted environment tools run in) that decides which credential files to deny or mask access to has been restructured. It now shows clearer warnings in two cases:
- when a deny rule for a credential file actually gives no protection because the filesystem policy is relaxed
- when a credential mask is dropped because a more trusted deny rule already covers it through a symlink
Why
These warnings make it easier to understand when a credential-protection rule isn't actually doing anything, instead of silently assuming files are protected when they aren't.