{"version":"2.1.271","anchor":"sandbox-credential-denymask-logic-reworked-with-clearer-war","canonical_anchor":"sandbox-credential-denymask-logic-reworked-with-clearer-war","heading":"Sandbox credential deny\/mask logic reworked with clearer warnings","tier":"notice","area":"Sandbox","scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271\/e\/sandbox-credential-denymask-logic-reworked-with-clearer-war","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.271","markdown":"### Sandbox credential deny\/mask logic reworked with clearer warnings\n\nSandbox credential protection logic rewritten with clearer warning messages\n\n**What**\n\nThe part of Claude Code's sandbox (a restricted environment tools run in) that decides which credential files to deny or mask access to has been restructured. It now shows clearer warnings in two cases:\n\n- when a deny rule for a credential file actually gives no protection because the filesystem policy is relaxed\n\n- when a credential mask is dropped because a more trusted deny rule already covers it through a symlink\n\n**Why**\n\nThese warnings make it easier to understand when a credential-protection rule isn't actually doing anything, instead of silently assuming files are protected when they aren't.\n\n- Area: Sandbox\n- Tier: You'll notice\n- Useful: 2\/5\n- Signal: 1\/5"}