From af090e0222f1c6c0ade8bd850d106d98bdd10257 Mon Sep 17 00:00:00 2001
From: mrizzi <mrizzi@redhat.com>
Date: Fri, 24 Jul 2026 16:36:06 +0200
Subject: [PATCH 1/2] feat(sandbox): add project-level credential deny entries

Create .claude/settings.json with sandbox.credentials.envVars deny
entries for 16 credential env vars across GCP, Anthropic/Vertex AI,
GitHub, and AWS categories. When contributors enable the sandbox,
these vars are stripped from Bash subprocesses while Claude Code
retains access for API authentication.

JIRA_API_TOKEN intentionally omitted (requires mask mode, which is
only available in user/managed settings).

Implements TC-5365

Assisted-by: Claude Code
---
 .claude/settings.json | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .claude/settings.json

diff --git a/.claude/settings.json b/.claude/settings.json
new file mode 100644
index 00000000..3bcda5c2
--- /dev/null
+++ b/.claude/settings.json
@@ -0,0 +1,24 @@
+{
+  "sandbox": {
+    "credentials": {
+      "envVars": [
+        { "name": "GOOGLE_APPLICATION_CREDENTIALS", "mode": "deny" },
+        { "name": "CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE", "mode": "deny" },
+        { "name": "GOOGLE_GHA_CREDS_PATH", "mode": "deny" },
+        { "name": "CLOUDSDK_AUTH_ACCESS_TOKEN", "mode": "deny" },
+        { "name": "CLOUDSDK_PROJECT", "mode": "deny" },
+        { "name": "CLOUDSDK_CORE_PROJECT", "mode": "deny" },
+        { "name": "GCP_PROJECT", "mode": "deny" },
+        { "name": "GCLOUD_PROJECT", "mode": "deny" },
+        { "name": "GOOGLE_CLOUD_PROJECT", "mode": "deny" },
+        { "name": "ANTHROPIC_API_KEY", "mode": "deny" },
+        { "name": "ANTHROPIC_VERTEX_PROJECT_ID", "mode": "deny" },
+        { "name": "CLOUD_ML_REGION", "mode": "deny" },
+        { "name": "GITHUB_TOKEN", "mode": "deny" },
+        { "name": "GH_TOKEN", "mode": "deny" },
+        { "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
+        { "name": "AWS_SESSION_TOKEN", "mode": "deny" }
+      ]
+    }
+  }
+}

From 2faa32e09a50b202bc11bffc6a322f81b2c2503b Mon Sep 17 00:00:00 2001
From: mrizzi <mrizzi@redhat.com>
Date: Fri, 24 Jul 2026 17:25:16 +0200
Subject: [PATCH 2/2] docs(sandbox): add credential isolation documentation to
 README

Add a Sandbox Credential Isolation section to README.md explaining
the .claude/settings.json deny entries, how to enable the sandbox
with /sandbox, verification steps, and JIRA_API_TOKEN mask mode
guidance for user-level settings.

Implements TC-5369

Assisted-by: Claude Code
---
 README.md | 51 +++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/README.md b/README.md
index f13c906a..1ce43218 100644
--- a/README.md
+++ b/README.md
@@ -72,6 +72,57 @@ slash commands.
 This interactively populates the required Project Configuration in your
 project's CLAUDE.md (repository registry, Jira settings, and code intelligence).
 
+## Sandbox Credential Isolation
+
+This repository includes a `.claude/settings.json` file that configures
+`sandbox.credentials.envVars` deny entries for 16 credential environment
+variables across four categories: GCP (9), Anthropic/Vertex AI (3),
+GitHub (2), and AWS (2). When the sandbox is enabled, these variables are
+stripped from Bash subprocesses while Claude Code's own runtime retains
+access for API authentication.
+
+The sandbox is **opt-in** — it is not enabled automatically. Run `/sandbox`
+at the start of each session to activate it.
+
+### Verifying the deny entries
+
+After enabling the sandbox, confirm that denied variables are stripped:
+
+```
+/sandbox
+```
+
+Then in a Bash command, check that a denied variable is empty:
+
+```bash
+echo "GITHUB_TOKEN=$GITHUB_TOKEN"
+```
+
+The output should show an empty value. If Claude Code can still call APIs
+(Jira, GitHub), the runtime retained its own access while the sandbox
+stripped the variable from the Bash subprocess.
+
+### JIRA_API_TOKEN
+
+`JIRA_API_TOKEN` is intentionally **not** included in the project-level deny
+entries. It requires `mask` mode (which redacts the value rather than
+removing it entirely), and `mask` can only be set from user-level settings,
+managed settings, or the `--settings` CLI flag — not from project-level
+`.claude/settings.json`. To mask it locally, add the following to your
+`.claude/settings.local.json`:
+
+```json
+{
+  "sandbox": {
+    "credentials": {
+      "envVars": [
+        { "name": "JIRA_API_TOKEN", "mode": "mask" }
+      ]
+    }
+  }
+}
+```
+
 ## Project Configuration
 
 For the skills to work with your project, your project's CLAUDE.md must