chore(release): 3.4.0

CHANGELOG.md

@@ -8,41 +8,78 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [3.4.0] - 2026-09-18
+
+Findings for the hardcoded-credential rules now report where a credential is
+without reproducing what it is. Minor rather than patch: the snippet a finding
+carries changes for every consumer that reads it, and the release adds a new
+rule-metadata key.
+
+### Upgrade notes
+
+No configuration change is required, but findings differ on the first run after
+upgrading.
+
+- **`codeSnippet` content changes for the credential rules.** The field keeps
+  the assignment target and surrounding syntax where that is unambiguous, as
+  well as the file and line, and masks the literal. A baseline keyed on exact
+  snippet text will not match; key on rule ID plus location instead. Rules whose
+  match is not a credential are unaffected. (#119)
+- **The same applies to `detailedReport.content` and `dataflowTrace`.** Both
+  quote source lines and both are masked on the same terms. (#119)
+- **A finding's `description` can also change.** OpenGrep expands metavariables
+  into a rule's message before returning a result, so a message quoting the
+  matched value carried it too. Expanded metavariables are masked for the
+  credential rules. (#119)
+- **Masking is deliberately conservative in several visible places.**
+  `define('SECRET', '...')` masks the constant name along with the value, and
+  `password: "admin"` hides which default was used. Ambiguous unquoted values
+  can also mask the rest of a statement or line rather than risk treating part
+  of the credential as source syntax. Rule ID, file and line still identify the
+  finding in each case. (#119)
+
 ### Fixed
 - **A finding's snippet no longer reproduces the value it reports.** A SAST
   finding's `codeSnippet` is the source line the rule matched. For nearly every
   rule that line is the code the finding is about; for the hardcoded-credential
   rules it contains the credential, so the finding carried the value into
   `.socket.facts.json`, the uploaded facts and the configured notifiers.
-  Snippets for those rules now keep the assignment target, the syntax, the file
-  and the line, and mask the literal's contents. This covers 20 rules across all
-  fifteen bundled language rule sets, not only the Python and JavaScript ones:
+  Snippets for those rules now keep the assignment target and syntax when safe,
+  keep the file and line, and mask the literal's contents. This covers 20 rules
+  across all fifteen bundled language rule sets, not only the Python and
+  JavaScript ones:
   `*-hardcoded-secret(s)`, `*-hardcoded-credentials`,
   `*-hardcoded-password-default`, `*-default-credentials`,
   `*-plain-text-password`, `*-weak-jwt-secret` and `*-empty-password`. Rules
-  whose match is not a credential keep their snippets verbatim.
-- Every snippet, dataflow-trace step and detailed report, whatever rule produced
-  it, is now masked of values matching a well-known credential format: AWS key
+  whose match is logic keep their snippets verbatim, and a complete assigned
+  call with a literal argument is treated as code, so
+  `user.password = request.form.get('password')` keeps its expression while the
+  quoted argument is masked. (#119)
+- Every snippet, dataflow-trace step, rule message and detailed report, whatever
+  rule produced it, is now masked of values matching a well-known credential
+  format: AWS key
   IDs, GitHub tokens, Stripe keys, Slack tokens, Google API keys, npm and PyPI
   tokens, JWTs, PEM private key bodies, and credentials in a URL authority. A
-  rule unrelated to secrets can still match a line that carries one.
+  rule unrelated to secrets can still match a line that carries one. (#119)
 - TruffleHog's `redactedValue` kept the first and last four characters of any
   value longer than eight, which left most of a short password readable. Values
-  under sixteen characters are now masked in full.
+  under sixteen characters are now masked in full. (#119)
 - TruffleHog no longer scans the facts file the run writes. That file lands
   inside the scan target, so a previous run's output was on disk during the walk
   and its contents were reported as findings of their own, pointing at the
-  output file rather than the source line.
+  output file rather than the source line. (#119)
 
 ### Changed
+- socketdev 3.5.0 -> 3.6.0 in the lockfile. The `>=3.5.0` floor in
+  `pyproject.toml` is unchanged. (#117)
 - `load_explicit_env_config` builds its "API key sources detected" debug line by
   iterating a tuple of variable names rather than a dict of presence booleans.
   The line is unchanged, including the exclusion of an exported-but-empty
-  variable.
+  variable. (#119)
 
 ### Added
 - A `redact` rule-metadata key. Set it on a custom SAST rule to mark the match
-  as a credential, or to opt a rule out; without it, the rule name decides.
+  as a credential, or to opt a rule out; without it, the rule name decides. (#119)
 
 ## [3.3.0] - 2026-09-15
 

README.md

@@ -35,7 +35,7 @@ jobs:
       - name: Run Socket Basics
         # Pin to a commit SHA for supply-chain safety.
         # Dependabot will keep this up to date automatically — see docs/github-action.md.
-        uses: SocketDev/socket-basics@<sha>  # v3.3.0
+        uses: SocketDev/socket-basics@<sha>  # v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -179,10 +179,10 @@ For GitHub Actions, see the [Quick Start](#-quick-start---github-actions) above
 
 ```bash
 # Pull the pre-built image (recommended — no build step required)
-docker pull ghcr.io/socketdev/socket-basics:3.3.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.0
 
 # Run scan
-docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.3.0 \
+docker run --rm -v "$PWD:/workspace" ghcr.io/socketdev/socket-basics:3.4.0 \
   --workspace /workspace \
   --python \
   --secrets \

action.yml

@@ -4,7 +4,7 @@ author: "Socket"
 
 runs:
   using: "docker"
-  image: "docker://ghcr.io/socketdev/socket-basics:3.3.0"
+  image: "docker://ghcr.io/socketdev/socket-basics:3.4.0"
   env:
     # Core GitHub variables (these are automatically available, but we explicitly pass GITHUB_TOKEN)
     GITHUB_TOKEN: ${{ inputs.github_token }}

docs/github-action.md

@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -57,7 +57,7 @@ With just your `SOCKET_SECURITY_API_KEY`, all scanning configurations are manage
 
 ### How the action is currently built
 
-When you reference `uses: SocketDev/socket-basics@v3.3.0`, GitHub Actions pulls the
+When you reference `uses: SocketDev/socket-basics@v3.4.0`, GitHub Actions pulls the
 pre-built image referenced by [`action.yml`](../action.yml). The historical multi-stage
 Docker build still matters for maintainers because it determines what lands in the
 published image:
@@ -75,7 +75,7 @@ Socket Basics from source in every workflow run.
 ### Pre-built image
 
 Starting with v2, the action pulls a pre-built image from GHCR rather than
-building from source on every run. Pinning to a specific version tag (e.g. `@v3.3.0`)
+building from source on every run. Pinning to a specific version tag (e.g. `@v3.4.0`)
 means the action starts in seconds — the image is built, integration-tested, and
 published before the release tag is ever created.
 
@@ -85,7 +85,7 @@ If you run socket-basics in other CI systems (Jenkins, GitLab, CircleCI, etc.) o
 as a standalone `docker run`, pull the pre-built image directly:
 
 ```bash
-docker pull ghcr.io/socketdev/socket-basics:3.3.0
+docker pull ghcr.io/socketdev/socket-basics:3.4.0
 ```
 
 See [Local Docker Installation](local-install-docker.md) for usage examples.
@@ -101,7 +101,7 @@ is immediately affected. We've seen this happen across the ecosystem:
   publish `:latest`/`:latest-heavy` Docker aliases as an onboarding
   convenience, but treat them as exactly that — production pipelines should
   pin an exact version or digest.)
-- **Version tags** (`@v3.3.0`) are better, but tags are mutable by default.
+- **Version tags** (`@v3.4.0`) are better, but tags are mutable by default.
   A tag can be deleted and recreated pointing at a different commit. There are
   documented cases of this happening — maliciously and accidentally.
 - **Commit SHAs** are the only truly immutable reference. A SHA cannot be
@@ -126,14 +126,14 @@ The only truly immutable reference. Dependabot keeps it current automatically.
 ```yaml
 - name: Run Socket Basics
   # Dependabot keeps this SHA up to date — see .github/dependabot.yml setup below.
-  uses: SocketDev/socket-basics@<sha>  # v3.3.0
+  uses: SocketDev/socket-basics@<sha>  # v3.4.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
 
 Get the SHA for any release:
 ```bash
-git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.3.0
+git ls-remote https://github.com/SocketDev/socket-basics refs/tags/v3.4.0
 ```
 
 ---
@@ -145,7 +145,7 @@ enforces tag protection rules). SHA pinning is still preferable for defence
 in depth.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 ```
@@ -166,7 +166,7 @@ updates:
 ```
 
 Dependabot opens a PR for each new release, updating the SHA or version tag
-and keeping the `# v3.3.0` comment in sync. You review, approve, and merge
+and keeping the `# v3.4.0` comment in sync. You review, approve, and merge
 on your own schedule — automated upgrades with a human gate.
 
 ---
@@ -176,7 +176,7 @@ on your own schedule — automated upgrades with a human gate.
 | Strategy | Immutable? | Auto-updates | Review gate |
 |---|---|---|---|
 | `@v2` floating tag | ❌ (not published) | — | — |
-| `@v3.3.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
+| `@v3.4.0` + Dependabot | ✅ (tag protection enforced) | Yes (weekly PR) | Yes |
 | `@<sha>` + Dependabot | ✅ always | Yes (weekly PR) | Yes |
 
 ## Basic Configuration
@@ -217,7 +217,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **SAST (Static Analysis):**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Enable SAST for specific languages
@@ -231,7 +231,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Secret Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     secret_scanning_enabled: 'true'
@@ -251,7 +251,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Container Scanning:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     # Listing images or Dockerfiles auto-enables the matching Trivy scan.
@@ -271,7 +271,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 
 **Socket Tier 1 Reachability:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_tier_1_enabled: 'true'
@@ -280,7 +280,7 @@ Include these in your workflow's `jobs.<job_id>.permissions` section.
 ### Output Configuration
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     python_sast_enabled: 'true'
@@ -318,7 +318,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Socket Basics (changed files only)
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -447,7 +447,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 
 **Enable in workflow:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   env:
     GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
   with:
@@ -460,7 +460,7 @@ Configure Socket Basics centrally from the [Socket Dashboard](https://socket.dev
 > [!NOTE]
 > You can also pass credentials using environment variables instead of the `with:` section:
 > ```yaml
-> - uses: SocketDev/socket-basics@v3.3.0
+> - uses: SocketDev/socket-basics@v3.4.0
 >   env:
 >     SOCKET_SECURITY_API_KEY: ${{ secrets.SOCKET_SECURITY_API_KEY }}
 >   with:
@@ -478,7 +478,7 @@ All notification integrations require Socket Enterprise.
 
 **Slack Notifications:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -490,7 +490,7 @@ All notification integrations require Socket Enterprise.
 
 **Jira Issue Creation:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -505,7 +505,7 @@ All notification integrations require Socket Enterprise.
 
 **Microsoft Teams:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -517,7 +517,7 @@ All notification integrations require Socket Enterprise.
 
 **Generic Webhook:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -529,7 +529,7 @@ All notification integrations require Socket Enterprise.
 
 **SIEM Integration:**
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     github_token: ${{ secrets.GITHUB_TOKEN }}
     socket_org: ${{ secrets.SOCKET_ORG }}
@@ -565,7 +565,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -607,7 +607,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Full Security Scan
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -666,7 +666,7 @@ jobs:
         run: docker build -t myapp:${{ github.sha }} .
 
       - name: Run Socket Basics (image + Dockerfile scan)
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number }}
         with:
@@ -727,7 +727,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -785,7 +785,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Run Socket Basics
-        uses: SocketDev/socket-basics@v3.3.0
+        uses: SocketDev/socket-basics@v3.4.0
         env:
           GITHUB_PR_NUMBER: ${{ github.event.pull_request.number || github.event.issue.number }}
         with:
@@ -946,7 +946,7 @@ in the [name mapping](parameters.md#name-mapping).
 ```yaml
 steps:
   - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 - Must be first
-  - uses: SocketDev/socket-basics@v3.3.0
+  - uses: SocketDev/socket-basics@v3.4.0
 ```
 
 ### PR Comments Not Appearing

docs/github-pr-comment-guide.md

@@ -315,7 +315,7 @@ PR. This is for teams who want to review finding quality in the Socket dashboard
 first, without every PR growing a comment that developers have to scroll past.
 
 ```yaml
-- uses: SocketDev/socket-basics@v3.3.0
+- uses: SocketDev/socket-basics@v3.4.0
   with:
     socket_security_api_key: ${{ secrets.SOCKET_SECURITY_API_KEY }}
     github_token: ${{ secrets.GITHUB_TOKEN }}