What's new at Socket?

Socket has always enforced a 1-year TTL (Time-To-Live) for immutable scans. Starting in November 2026, we will also enforce this for alert and event data. We are doing this for data hygiene, retention, and performance reasons.

If you need to keep backups of data older than one year, we recommend using data exports, which can take periodic 24-hour snapshots of your alert and event data.

To back up data which is already older than one year, you can use the historical alerts API or the events API.

If you would like to back up your immutable scans, you can use the full scans API/diff scans API with has_cached_result=true and the full scan API/diff scan API with if_cached=true to enumerate and download all immutable scans.

Socket now supports creating and managing Asana tasks from alerts. Tasks can be created manually or through ticketing rules that filter by event, type, priority, repository, or other attributes; select the Asana workspace, project, tags, and assignee; and configure how the linked task and alert update as their status changes.

The integration is available in beta on Business and Enterprise plans. Read the announcement and documentation.

PHP and Composer support has moved from Experimental to Beta and is now available for all Socket users. PHP reachability analysis is now generally available for customers on Team plans and higher and no longer requires Experimental access.

Read the announcement, and check out the documentation for precomputed reachability and full application reachability.

Socket now scans every Firefox extension listed in Mozilla’s official add-ons directory and monitors new releases for changes in permissions, code, network activity, and behavior. Analysis covers extension metadata, active sites, package files, network endpoints, malware, credential and clipboard theft, data exfiltration, remote loading, obfuscation, impersonation, and related campaign activity.

Firefox coverage is available in Experimental for Enterprise customers. Contact your Socket account team to enable it, and read the announcement for more details.

Socket now correctly scans crates.io package versions that have been yanked but remain pinned in a project’s Cargo.lock, preventing failures for projects that still depend on archived crate versions.

Repository-scoped API tokens can now retrieve the supported-files list required to start reachability scans. This fixes an issue where scans authenticated with a repository-scoped token could fail with a 403 error before analysis began, making it easier to use least-privilege credentials with the Socket API.

Packagist package pages now show the full commit history for tags that have been force-pushed, with the commit currently associated with the tag highlighted. This makes it easier to identify when a published package version has been retagged and review the commits it previously referenced.

Full scan metadata responses now consistently include the repository, workspace, report URL, API URL, and scan type fields documented in the API contract.

Private packages that Socket cannot score now display N/A instead of a numeric score in pull request comments and dependency views. This prevents private packages from appearing to have passed or failed analysis when no score is available.

Fixed an issue where pull request detail pages could return a "Not Found" error after a workspace was renamed, even though the pull request still appeared in the list. Existing pull request links now continue to work after workspace renames without requiring any additional action.