Claude 8a00d63856 docs: explicit known-secret deny list, wildcards via profile only ...

Drop generic *_TOKEN / *_SECRET catch-alls from the built-in default deny
list to avoid clipping legitimate build variables. The matching engine
still supports glob patterns so users can opt into broad denies per
sandbox profile (e.g. deny: ["*_TOKEN", "AWS_*"]).

https://claude.ai/code/session_017Da1sAYLYpeEgogm6f9VYW

2026-06-10 01:35:06 +00:00

..

env-var-protection.md

docs: explicit known-secret deny list, wildcards via profile only

2026-06-10 01:35:06 +00:00