You'll noticeTier: how much it should matter to you
2Useful: my rating, 1 to 5
1Signal: worth watching, 1 to 5
SandboxArea: what it touches
ImprovementsKind: in v2.1.271,
ImprovementsSection of the release
What
The part of Claude Code's sandbox (a restricted environment tools run in) that decides which credential files to deny or mask access to has been restructured. It now shows clearer warnings in two cases:
when a deny rule for a credential file actually gives no protection because the filesystem policy is relaxed
when a credential mask is dropped because a more trusted deny rule already covers it through a symlink
Why
These warnings make it easier to understand when a credential-protection rule isn't actually doing anything, instead of silently assuming files are protected when they aren't.
