diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..d23d005
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2023-10-17 - Case-insensitive Environment Variable Filtering
+**Vulnerability:** The sandbox stripped sensitive environment variables (like AWS_, OPENAI_ keys) using a case-sensitive prefix check, allowing lowercase equivalents to bypass the filter.
+**Learning:** Environment variables may be set using various cases depending on the system or configuration. Hardcoded uppercase prefix matching in JavaScript is insufficient.
+**Prevention:** Always convert keys to a uniform case (e.g., uppercase) before checking against prefixes or use case-insensitive regex.
diff --git a/packages/core/src/policy.ts b/packages/core/src/policy.ts
index 18dbb16..1afc129 100644
--- a/packages/core/src/policy.ts
+++ b/packages/core/src/policy.ts
@@ -205,7 +205,7 @@ export class PolicyEngine {
     if (mode === "sandbox") {
       const stripPrefixes = ["AWS_", "OPENAI_", "ANTHROPIC_", "GITHUB_TOKEN", "NPM_TOKEN"];
       for (const key of Object.keys(env)) {
-        if (stripPrefixes.some((prefix) => key.startsWith(prefix))) {
+        if (stripPrefixes.some((prefix) => key.toUpperCase().startsWith(prefix))) {
           delete env[key];
         }
       }