What's new at Socket?

Fixed an issue affecting firewall and CLI event visibility on the Events page for organizations created since October 20, 2026.

Organization owners and members with unrestricted access can now view these events in lists, charts, filters, and event details. Existing repository-level access restrictions remain unchanged.

You can now filter the Active Alerts page by when an alert was created. Choose from preset time periods including Today, the last 7, 14, 30, or 90 days, or select a custom date range using the calendar.

The new Created date filter supports dates between, since, or through a selected day. Filters are preserved in URLs and saved views, making it easier to return to specific time periods.

We've also updated the Full Scans date filter with the same presets and custom date range options.

Filters and search terms on a scan report's Dependencies tab now remain applied when switching between Directs and No grouping.

Previously, changing the grouping cleared the search text and most filters. Now, your selections are preserved, including filters that are temporarily hidden in a different grouping view. You can switch between views without having to reapply your filters or search.

By default, organization-wide alerts track the default branch of a repository (e.g. main or master). Some teams, however, ship multiple branches to production simultaneously. For example, you may have multiple "rings" of customers, including beta, canary, legacy, previous, etc.

If you would like to see alerts across all of these branches, and to emit webhooks, emails, or other forms of notifications, you can add a tracked branch. This can be found in Settings -> Scans -> Tracked Branches.

You can specify a plain name for the branch, or a glob expression. This works automatically with Socket's SCM integration (e.g. GitHub). API users must set the branch and set_as_pending_head fields when creating a full scan.

When viewing the alerts in the dashboard, the results are broken down hierarchically by label, repository, and branch:

You can add any number of branch patterns, but only a maximum of 5 branches per repository is currently supported.

On November 10, 2026, we're removing the Obfuscated code alert from our "Balanced" and "Comprehensive" security policy presets ("Essential" doesn't include it and won't change). This is in response to customer feedback that the signal provided by Obfuscated code is better covered by other directly-actionable alerts. Socket will still detect obfuscated code, but the alert for it will no longer be in our preset defaults.

If you've previously set your own action or rule for Obfuscated code, nothing changes for you. If you want to keep seeing Obfuscated code alerts after November 10, open Settings → Security Policy and set Obfuscated code to "Warn" or "Monitor" (instead of "Inherit"). If your organization uses the Policies page, add a rule for Obfuscated code with "Warn" or "Monitor".

The deprecated GET /v0/report/view/{id} endpoint will be retired on November 20, 2026. Its Sunset response header now advertises that deadline. Update your integrations to use GET /v0/orgs/{org_slug}/full-scans/{full_scan_id} before that date. See the Full Scans API documentation for the supported replacement.

You can now bulk-create Jira, Linear, Asana, and ClickUp tickets for manifest alerts such as Missing lockfile, with one ticket per repository and manifest file. Tickets show the correct manifest path and ecosystem and are scoped to the selected repository and branch. You can also shift-click to select a range of alerts for bulk actions. This update also fixes missing Linear ticket updates for workspaces with multiple installations.

The Fixes API documentation now covers the asynchronous endpoints for starting a fix computation and polling for its results, including supported parameters and the result format. This workflow helps avoid timeouts on large projects or first runs. The synchronous endpoint is now deprecated in favor of the async endpoints but continues to work.

For user OAuth sessions governed by repository or workspace policies, Socket now checks repository access before computing fixes and before returning results, including cached results. Unfiltered repository endpoints return an access-denied (403) response for these sessions, keeping repository data within the permitted scope. Policy-management and resource-discovery routes are also blocked for these sessions.

API keys now use a consistent masked format, such as sktsec_…Xy9Q, across the dashboard and API. Token-list responses also include non-secret token_prefix and token_last4 fields, making it easier to identify keys without parsing the display string. Integrations that parse the previous masked format may need updating. Actual credentials and token IDs are unchanged, and omitted token values still return null.