Describe the log redaction by what it does rather than what it prevented

The changelog entry and the module and test docstrings spelled out the
failure mode in enough detail to serve as a lookup guide, on a public
repository, before the fix has shipped. Reworded to describe the
behaviour -- configuration values and integration URLs are redacted in
log output -- without the specifics.

No functional change; redaction behaviour and tests are untouched.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: lelia

CHANGELOG.md

@@ -2,19 +2,10 @@
 
 ## 2.8.1
 
-### Fixed: credentials could appear in debug log output
-
-- Running with `--debug` logged the whole configuration, including the Socket API
-  token, in clear text. In CI that lands in the job log, which is retained, shared
-  in support tickets and world-readable for public repositories. Configuration is
-  now logged through a redacted view that masks credential-bearing fields.
-- The Slack integration logged the full webhook URL, once unconditionally at debug
-  level. A webhook URL is a bearer credential -- anyone holding it can post into
-  the channel. These log lines now show only the scheme and host. Because the
-  Slack plugin runs while server log streaming is active, and that handler applies
-  no level filter, those URLs were also being uploaded to Socket.
-- If a Socket API token or Slack webhook URL may have been exposed in CI logs,
-  rotate it.
+### Fixed: debug logging could include sensitive configuration values
+
+- Debug-level output could include configuration values and integration URLs
+  verbatim. Both are now redacted in log output.
 
 ### Fixed: manifest links used the wrong host for some organizations
 

socketsecurity/redaction.py

@@ -1,11 +1,7 @@
 """Helpers for keeping credentials out of anything that reaches a log line.
 
-The CLI runs inside other people's pipelines. Its stdout is captured into CI job
-logs that are retained, pasted into support tickets, and world-readable for
-public repositories. Some of those records are also shipped to Socket by the log
-streamer in `core/streaming.py`, whose upload handler has no level filter and
-runs with its loggers forced to DEBUG -- so a debug line emitted while streaming
-is active leaves the machine entirely.
+The CLI runs inside other people's pipelines, and log output can be retained by
+CI and forwarded elsewhere, so credentials must not reach it.
 
 Nothing here tries to be a general-purpose scrubber. It covers the two shapes
 the CLI actually holds: a config mapping with credential-ish field names, and a
@@ -42,10 +38,9 @@ def is_sensitive_name(name: str) -> bool:
 def redact_url(value: Any) -> Any:
     """Reduce a URL to scheme and host, dropping the parts that carry secrets.
 
-    A Slack webhook URL is a bearer credential: the secret is the path, and
-    anyone holding it can post into the customer's channel. Keeping the host
-    preserves what the debug line was for -- seeing *which* endpoint is
-    configured -- without printing the credential.
+    For webhook-style URLs the sensitive part is the path, so keeping the host
+    preserves what a debug line is for -- seeing which endpoint is configured --
+    without writing the rest.
 
     Values that are not absolute URLs are returned unchanged, so placeholders
     such as "Not configured" stay readable.

tests/unit/test_redaction.py

@@ -1,9 +1,7 @@
 """Tests for credential redaction in log output.
 
-The CLI runs in customer CI. Its stdout lands in job logs that are retained,
-shared in support tickets and public for public repositories, and the log
-streamer uploads records to Socket with no level filter. Credentials must not
-reach any of that.
+Log output can be retained by CI and forwarded elsewhere, so credentials must
+not reach it.
 """
 
 import dataclasses