From 036348cd2bc8459a2d6db0587f07266e1a025f8d Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 30 Jul 2026 09:48:32 +0000
Subject: [PATCH] Artifact review: stop the credential at the API boundary
 (v2.8.0)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Driven by reading the artifacts of a real v2.7.9 deep scan side by side — the
dashboard modal, the Discord alert, and the SARIF/CSV/HTML of the same three
findings. v2.7.9 fixed redaction in the reports; comparing the surfaces showed
how much of that job was left undone everywhere else, and turned up two
correctness bugs that had nothing to do with display.

A re-scan of an unchanged site reported CLEAN while the credential was still
exposed. The asset cache treated a 304 on the root page as "unchanged and
previously clean, skip", but a page is a link graph — skipping its body meant
never parsing its <script> tags, so every bundle it referenced dropped out of
the scan. Reproduced on a lab target: scan 1 found a planted key, scan 2 never
requested the file holding it. Crawled pages now always return a body; the
conditional GET is still sent, so unchanged terminal assets still skip.

The dashboard rendered the full credential. redact_secret() landed in report.py
only, so the REST API and WebSocket shipped raw_match verbatim and the modal
displayed it under a "MATCHED VALUE (PARTIAL)" heading a 51-character key fits
inside. Masking now happens at the API boundary with no opt-out;
REPORT_FULL_SECRETS still works for a report an operator deliberately generates.
Capturing a live WebSocket stream also caught scan_complete shipping both
unmasked finding lists in the final frame of every scan, and the code snippet
carrying the secret the matched-value field was hiding. The JSON export was the
one deliverable format still returning the stored record as-is.

The dashboard showed MEDIUM for findings the reports called HIGH: severity was
re-derived in the frontend from a hardcoded list of 14 type names, so every
detector added since — the whole AI/ML provider family — hit the MEDIUM default.
It now reads the field the backend already computes. Discord had the same shape
of bug twice: a version literal stale since 2.4.0, and a per-type colour table
covering 16 of 60+ detectors.

Deep-scan reports lost every scan-level metric, which is why a 25-host SARIF
claimed assets_fetched: 0. Rolled up, with duration as wall-clock rather than
summed across concurrent hosts. Asset counting now separates downloaded from
cached-but-covered, so a fully-cached re-scan no longer reports "0 assets
analysed". Deep scans also start from an empty asset cache instead of
inheriting module state from whatever ran before them.

Suite 347 -> 382, including a mutation check that the leak guards can fail and
a reproduction of the false all-clear. Lint clean, detection benchmark 1.00/1.00.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V6XK23ZKmYtCovRte9a73E
---
 .env.example               |  20 +-
 CHANGELOG.md               |  76 ++++++
 backend/main.py            |  88 ++++++-
 backend/orchestrator.py    |  49 ++++
 backend/report.py          | 111 ++++++--
 backend/scanner.py         | 105 ++++++--
 backend/tests/test_v280.py | 516 +++++++++++++++++++++++++++++++++++++
 backend/version.py         |  35 +++
 frontend/index.html        |  39 ++-
 pyproject.toml             |   2 +-
 10 files changed, 964 insertions(+), 77 deletions(-)
 create mode 100644 backend/tests/test_v280.py
 create mode 100644 backend/version.py

diff --git a/.env.example b/.env.example
index d488f4d..374b8f0 100644
--- a/.env.example
+++ b/.env.example
@@ -157,20 +157,28 @@ SCAN_HTTP_POSTURE=true
 # The raw HTML is already scanned, so a plainly-embedded secret is caught either
 # way; this decodes the JSON so a credential mangled by \uXXXX escaping is still
 # recognised. Local decode only — no extra requests, scan stays passive.
-# Asset caching (v2.7.7). Sends If-None-Match / If-Modified-Since on re-scans.
-# An asset that is BOTH unchanged (304) AND produced no finding last time is
-# skipped entirely; one that previously had a finding is always refetched so the
-# finding cannot silently vanish from a report. No response body is ever cached
-# — only validators, a content hash, and a clean/dirty flag — because a client's
-# JavaScript can contain live credentials. Cache entries expire after 24h.
 # Client reports redact the credential by default (sk_abc…******…3fc4 (51 chars)).
 # A report gets emailed, forwarded and archived, so writing a live secret into
 # one turns the deliverable itself into a second exposure — and the RoE we ask
 # clients to sign promises redaction. The redacted form stays greppable, so a
 # developer can still identify exactly which key to rotate. Set true only when
 # you deliberately need the full value in the artefact.
+#
+# This affects generated reports ONLY. The dashboard, the WebSocket stream and
+# the REST API always mask, with no opt-out — those are screen-sharing and
+# screenshot surfaces, not deliverables an operator chose to produce.
 REPORT_FULL_SECRETS=false
 
+# Asset caching (v2.7.7). Sends If-None-Match / If-Modified-Since on re-scans.
+# A *terminal* asset (JS bundle, source map) that is BOTH unchanged (304) AND
+# produced no finding last time is skipped entirely; one that previously had a
+# finding is always refetched so the finding cannot silently vanish from a
+# report. Crawled HTML pages are never skipped, even when unchanged (v2.8.0): a
+# page is a link graph, and skipping its body means never discovering the
+# bundles it references — which turned a re-scan of an unchanged site into a
+# false all-clear. No response body is ever cached — only validators, a content
+# hash, and a clean/dirty flag — because a client's JavaScript can contain live
+# credentials. Cache entries expire after 24h.
 ASSET_CACHE=true
 
 SCAN_INLINE_JSON=true
diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3e1080..63ad2b8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,82 @@
 All notable changes to SecretNode are documented here. This project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [2.8.0] — Artifact review: the credential stops at the API boundary
+
+Driven by a side-by-side read of the artifacts from a real v2.7.9 deep scan — the dashboard modal,
+the Discord alert, and the SARIF/CSV/HTML exports of the same three findings. v2.7.9 had fixed
+redaction in the *reports*; comparing the surfaces showed how much of the same job was left undone
+everywhere else, and turned up two correctness bugs that had nothing to do with display.
+
+### Fixed
+
+- **A re-scan of an unchanged site reported CLEAN while the credential was still exposed.** The
+  worst bug in this release, and the only one that produces a wrong *answer* rather than a wrong
+  *presentation*. The asset cache treated a `304 Not Modified` on the root page as "unchanged and
+  previously clean, skip" — but an HTML page is a link graph, not just something to grep. Skipping
+  its body meant never parsing its `<script>` tags, so every JS bundle it referenced dropped out of
+  the scan. Reproduced on a lab target: scan 1 found a planted key, scan 2 never requested the file
+  holding it and reported no findings. Crawled pages now always come back with a body
+  (`allow_cache_skip=False`) — the conditional GET is still sent, so the bandwidth saving on
+  unchanged terminal assets (JS bundles, source maps) is untouched.
+- **The dashboard rendered the full credential.** `redact_secret()` was added to `report.py` in
+  v2.7.9 and nowhere else, so `/api/scans/{id}` and the WebSocket stream shipped `raw_match`
+  verbatim and the finding-detail modal displayed it — under a heading reading "MATCHED VALUE
+  (PARTIAL)" that a 51-character key comfortably fit inside. Redaction now happens at the API
+  boundary (`public_scan` / `public_event` in `main.py`) using a `mask_secret()` that has no
+  opt-out; `REPORT_FULL_SECRETS` remains available for a report an operator deliberately generates,
+  but no longer unmasks every dashboard session and WebSocket subscriber.
+- **The `scan_complete` event carried both unmasked finding lists.** Found by capturing a live
+  WebSocket stream rather than by reading the code: per-finding events were being scrubbed, but the
+  final frame of every scan ships the entire result dict, and it was going out untouched.
+- **The code snippet leaked the secret the matched-value field was hiding.** `context_snippet` was
+  stored and served verbatim, so the modal and the JSON export both contained the credential in
+  full even once `raw_match` was masked. Now masked in `ValidatedFinding.to_dict()`, where the
+  complete value is still available to match against — masking it downstream from the 80-character
+  `raw_match` cap would have left the tail of a longer secret exposed.
+- **The JSON export was the one deliverable format still containing live keys.** HTML, CSV and
+  SARIF all redacted; `format=json` returned the stored record as-is.
+- **The dashboard showed MEDIUM for findings the reports called HIGH.** The frontend re-derived
+  severity from a hardcoded list of 14 secret type names. Every detector added since that list was
+  written — the entire AI/ML provider family — fell through to the MEDIUM default. It now reads the
+  `severity` field the backend already computes from the pattern registry. A missing `.badge-low`
+  style meant LOW findings rendered unstyled; added.
+- **Discord alerts announced "SecretNode v2.4.0"** for five releases, and coloured every embed with
+  a per-type table covering 16 of 60+ detectors — so an ElevenLabs key and an AWS root key arrived
+  looking identical. Version now comes from the shared `version.py`; embed colour is keyed on
+  effective severity, and the severity is stated as a field.
+- **Deep-scan reports lost every scan-level metric.** `DeepScanResult.to_dict()` never emitted
+  `assets_fetched`, so a SARIF from a 25-host run claimed `assets_fetched: 0`; the same omission
+  dropped `raw_findings`, `duration_seconds`, posture findings and the verification counts. All are
+  now rolled up, with duration measured as wall-clock rather than summed across concurrently
+  scanned hosts.
+- **A fully-cached re-scan reported "0 assets analysed".** True as a download count, wrong as
+  coverage — it reads as "nothing was scanned". Split into `assets_fetched` (downloaded),
+  `assets_cached` (unchanged and clean, skipped) and `assets_scanned` (coverage); reports lead with
+  coverage and name the cached portion.
+- **Deep scans inherited asset-cache state from whatever ran before them in the same process.** The
+  cache is module-level and only the single-target endpoint primes it, so a deep scan could report
+  a previous scan's cache hits as its own coverage — and, worse, act on a stale validator. Deep
+  scans now start from an empty cache, and `run_scan` resets the hit tally alongside the throttle.
+
+### Changed
+
+- Deep-scan HTML gains the redacted matched value, verification status and impact per finding, plus
+  an asset-coverage stat — the format a client actually reads was the one carrying the least
+  evidence. It also notes that one value appearing on several hosts is a single credential shared
+  across environments, which is what a fanned-out dev/QA/preprod exposure actually looks like.
+- SARIF results carry `matched_value_partial`, `found_at` and (on deep scans) the originating
+  `host`, so a triager can correlate a result against the CSV row and the Discord alert. Run
+  properties gained coverage and duration.
+- Version is single-sourced in `backend/version.py`; a test now fails the build on any hardcoded
+  `SecretNode vX.Y.Z` literal in the backend.
+
+### Tests
+
+- `test_v280.py`: 35 tests covering each fix, including a mutation check that the leak guards can
+  actually fail, and a reproduction of the false all-clear. Suite: 347 → 382.
+
+
 ## [2.7.9] — Deep QA before release: reports no longer leak the credential
 
 A full pre-PR QA pass: booted the application, ran real end-to-end scans against a local target
diff --git a/backend/main.py b/backend/main.py
index 30a0285..5428972 100644
--- a/backend/main.py
+++ b/backend/main.py
@@ -179,6 +179,72 @@ async def broadcast_global(self, event: dict[str, Any]) -> None:
 _registry: dict[str, dict[str, Any]] = {}
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# Credential redaction at the API boundary
+# ─────────────────────────────────────────────────────────────────────────────
+#
+# The registry and SQLite hold the full matched value on purpose: report
+# generation needs it (report.py masks on the way out, and REPORT_FULL_SECRETS
+# lets an operator opt into the real value in a report they control), and the
+# fingerprint used for false-positive suppression is derived from it.
+#
+# What must never happen is that value reaching a browser or a WebSocket
+# subscriber. Until now it did: /api/scans/{id} returned the finding dicts
+# verbatim and the dashboard's finding-detail modal rendered `raw_match` under
+# a "MATCHED VALUE (PARTIAL)" heading that was simply not true — a 51-character
+# key fits inside the 60-character client-side slice. The dashboard is served
+# over whatever transport the operator deployed it on, gets screenshotted into
+# tickets, and is the one surface a client is most likely to be looking at
+# over someone's shoulder.
+#
+# So: redact here, at the boundary, and leave storage untouched.
+
+_FINDING_LISTS = ("confirmed_findings", "needs_review_findings")
+
+
+def public_finding(finding: dict[str, Any]) -> dict[str, Any]:
+    """Return a copy of a finding safe to hand to an API/WebSocket client."""
+    raw = finding.get("raw_match")
+    if not raw:
+        return finding
+    # mask_secret, not redact_secret: REPORT_FULL_SECRETS is an opt-in for a
+    # report the operator generates and controls, not for every dashboard
+    # session and WebSocket subscriber.
+    return {**finding, "raw_match": report_gen.mask_secret(str(raw))}
+
+
+def public_scan(scan: dict[str, Any]) -> dict[str, Any]:
+    """Return a copy of a scan record with every credential masked."""
+    if not isinstance(scan, dict):
+        return scan
+    out = dict(scan)
+    for key in _FINDING_LISTS:
+        findings = out.get(key)
+        if isinstance(findings, list):
+            out[key] = [public_finding(f) if isinstance(f, dict) else f
+                        for f in findings]
+    return out
+
+
+def public_event(event: dict[str, Any]) -> dict[str, Any]:
+    """Redact live scan events before they go out over a WebSocket.
+
+    Two shapes carry findings, and missing the second is easy: the per-finding
+    events wrap one finding under "data", but `scan_complete` ships the entire
+    result dict under "result" — including both finding lists. Scrubbing only
+    the former left the whole unmasked set going out in the final frame of
+    every scan.
+    """
+    etype = event.get("type")
+    if etype in ("finding", "finding_needs_review"):
+        data = event.get("data")
+        return {**event, "data": public_finding(data)} if isinstance(data, dict) else event
+    if etype in ("scan_complete", "deep_scan_complete"):
+        result = event.get("result")
+        return {**event, "result": public_scan(result)} if isinstance(result, dict) else event
+    return event
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # Lifespan
 # ─────────────────────────────────────────────────────────────────────────────
@@ -317,7 +383,7 @@ async def start_scan(request: ScanRequest, http_request: Request) -> dict[str, A
     state   = ScanState()
 
     async def broadcaster(event: dict[str, Any]) -> None:
-        await manager.broadcast_scan(scan_id, event)
+        await manager.broadcast_scan(scan_id, public_event(event))
 
     async def _run() -> None:
         try:
@@ -427,7 +493,7 @@ async def start_deep_scan(request: DeepScanRequest, http_request: Request) -> di
     scan_id = str(uuid.uuid4())
 
     async def broadcaster(event: dict[str, Any]) -> None:
-        await manager.broadcast_scan(scan_id, event)
+        await manager.broadcast_scan(scan_id, public_event(event))
 
     async def _run() -> None:
         try:
@@ -495,7 +561,7 @@ async def list_scans(
 ) -> dict[str, Any]:
     """List known scans for this session (in-memory)."""
     scans = [
-        entry["meta"]
+        public_scan(entry["meta"])
         for entry in list(_registry.values())[offset: offset + limit]
     ]
     return {"scans": scans, "count": len(scans)}
@@ -507,7 +573,7 @@ async def scan_history(
     offset: int = Query(default=0, ge=0),
 ) -> dict[str, Any]:
     """List all scans ever run, persisted in SQLite — survives restarts."""
-    scans = await load_scans(limit=limit, offset=offset)
+    scans = [public_scan(s) for s in await load_scans(limit=limit, offset=offset)]
     return {"scans": scans, "count": len(scans)}
 
 
@@ -515,14 +581,14 @@ async def scan_history(
 async def get_scan(scan_id: str) -> dict[str, Any]:
     entry = _registry.get(scan_id)
     if entry:
-        meta = entry["meta"].copy()
+        meta = public_scan(entry["meta"])
         task: asyncio.Task = entry["task"]
         if task.done():
             meta["status"] = "complete" if not task.cancelled() else "cancelled"
         return meta
     persisted = await load_scan(scan_id)
     if persisted:
-        return persisted
+        return public_scan(persisted)
     raise HTTPException(status_code=404, detail="Scan not found")
 
 
@@ -538,11 +604,15 @@ async def get_scan_status(scan_id: str) -> dict[str, Any]:
     return {
         "scan_id": scan_id,
         "status":  status,
-        "meta":    entry["meta"],
+        "meta":    public_scan(entry["meta"]),
     }
 
 
 async def _resolve_scan(scan_id: str) -> dict[str, Any]:
+    """Fetch the *unredacted* scan record for report generation. Every report
+    format masks the credential itself (report.redact_secret), so this is the
+    one path that must not pre-redact — otherwise a report would show a mask of
+    a mask, and REPORT_FULL_SECRETS would have nothing left to reveal."""
     entry = _registry.get(scan_id)
     if entry:
         return entry["meta"]
@@ -594,7 +664,7 @@ async def get_scan_report(
         return Response(content=body, media_type="application/sarif+json", headers={
             "Content-Disposition": f'attachment; filename="secretnode_report_{scan_id[:8]}.sarif"'
         })
-    return JSONResponse(content=scan)
+    return JSONResponse(content=report_gen.generate_json_report(scan))
 
 
 @app.post("/api/findings/suppress", dependencies=[Depends(require_api_key)])
@@ -638,7 +708,7 @@ async def list_suppressed_findings(
 @app.get("/api/active", dependencies=[Depends(require_api_key)])
 async def active_scans() -> dict[str, Any]:
     active = [
-        entry["meta"]
+        public_scan(entry["meta"])
         for entry in _registry.values()
         if not entry["task"].done()
     ]
diff --git a/backend/orchestrator.py b/backend/orchestrator.py
index 43224f3..349fd70 100644
--- a/backend/orchestrator.py
+++ b/backend/orchestrator.py
@@ -26,6 +26,7 @@
 import logging
 import os
 import socket
+import time
 from dataclasses import dataclass, field
 from typing import Awaitable, Callable
 
@@ -88,6 +89,7 @@ class DeepScanResult:
     scans: list[dict] = field(default_factory=list)   # raw per-host scan dicts
     historical_urls: int = 0        # historical URLs discovered (0 if not requested)
     takeover_findings: list[dict] = field(default_factory=list)  # dangling-CNAME hijack risks
+    duration_seconds: float = 0.0   # wall-clock for the whole run
     error: str | None = None
 
     @property
@@ -102,6 +104,18 @@ def total_needs_review(self) -> int:
     def total_posture(self) -> int:
         return sum(h.posture_issues for h in self.hosts)
 
+    @property
+    def total_assets(self) -> int:
+        return sum(h.assets for h in self.hosts)
+
+    @property
+    def total_assets_scanned(self) -> int:
+        """Coverage across the domain: downloaded plus served-from-cache."""
+        return self._sum_scans("assets_scanned") or self.total_assets
+
+    def _sum_scans(self, key: str) -> int:
+        return sum(int(s.get(key, 0) or 0) for s in self.scans)
+
     def _aggregate(self, key: str) -> list[dict]:
         """Flatten a per-host finding list across all scans, tagging each finding
         with the host it came from so the combined report can show provenance."""
@@ -122,14 +136,37 @@ def to_dict(self) -> dict:
             "historical_urls": self.historical_urls,
             "confirmed_findings": self._aggregate("confirmed_findings"),
             "needs_review_findings": self._aggregate("needs_review_findings"),
+            "posture_findings": self._aggregate("posture_findings"),
             "associated_hosts": sorted({h for s in self.scans
                                         for h in s.get("associated_hosts", [])}),
             "takeover_findings": self.takeover_findings,
+            # Scan-level metrics, rolled up from the per-host scans. These are
+            # top-level (not nested under "totals") because report.py reads them
+            # from the same keys a single-target scan uses — omitting them is
+            # why a deep-scan SARIF reported "assets_fetched: 0" after crawling
+            # 25 hosts, and why the CSV/HTML lost the screening funnel entirely.
+            "assets_fetched": self.total_assets,
+            "assets_cached": self._sum_scans("assets_cached"),
+            "assets_scanned": self.total_assets_scanned,
+            "raw_findings": self._sum_scans("raw_findings"),
+            "validated_findings": self._sum_scans("validated_findings"),
+            "suppressed_count": self._sum_scans("suppressed_count"),
+            "new_findings_count": self._sum_scans("new_findings_count"),
+            "recurring_findings_count": self._sum_scans("recurring_findings_count"),
+            "verified_count": self._sum_scans("verified_count"),
+            "unverified_count": self._sum_scans("unverified_count"),
+            "filtered_unverified_count": self._sum_scans("filtered_unverified_count"),
+            # Wall-clock, not the sum of per-host durations: hosts are scanned
+            # concurrently, so summing them would overstate the run by the
+            # concurrency factor.
+            "duration_seconds": round(self.duration_seconds, 2),
             "totals": {
                 "subdomains": len(self.subdomains),
                 "live_hosts": len(self.live_hosts),
                 "hosts_scanned": len(self.hosts),
                 "historical_urls": self.historical_urls,
+                "assets_fetched": self.total_assets,
+                "assets_scanned": self.total_assets_scanned,
                 "confirmed": self.total_confirmed,
                 "needs_review": self.total_needs_review,
                 "posture_issues": self.total_posture,
@@ -216,6 +253,15 @@ async def run_deep_scan(
 
     Falls back to scanning the bare target itself when the input is an IP or has
     no enumerable domain, so a deep scan always does *something* useful."""
+    started = time.monotonic()
+
+    # Deep scans do not use the conditional-GET cache yet: it is keyed per
+    # target_url and primed by the single-target endpoint, and hosts here run
+    # concurrently against shared module state. Start from empty so a deep scan
+    # can never inherit a previous single scan's validators and skip an asset it
+    # has never actually fetched.
+    scanner.load_asset_cache({})
+
     domain = recon.extract_registrable_domain(target)
     if domain is None:
         # No enumerable domain (e.g. an IP): degrade to a single passive scan of
@@ -228,6 +274,7 @@ async def run_deep_scan(
         result.live_hosts = [url]
         result.hosts = [_summarise_scan(host, url, scan)]
         result.scans = [scan]
+        result.duration_seconds = time.monotonic() - started
         return result
 
     async def emit(event: dict) -> None:
@@ -309,6 +356,7 @@ def log(msg: str, level: str = "INFO") -> dict:
 
         if not result.live_hosts:
             result.error = enum.error or "no live hosts found"
+            result.duration_seconds = time.monotonic() - started
             await emit(log("No live hosts to scan.", "WARN"))
             await emit({"type": "deep_scan_complete", "totals": result.to_dict()["totals"]})
             return result
@@ -348,5 +396,6 @@ async def _scan_host(url: str) -> tuple[HostScan, dict | None]:
             if scan is not None:
                 result.scans.append(scan)
 
+    result.duration_seconds = time.monotonic() - started
     await emit({"type": "deep_scan_complete", "totals": result.to_dict()["totals"]})
     return result
diff --git a/backend/report.py b/backend/report.py
index c564949..9edee10 100644
--- a/backend/report.py
+++ b/backend/report.py
@@ -22,9 +22,10 @@
 import os
 import json
 from datetime import datetime, timezone
-from pathlib import Path
 from typing import Any
 
+import version
+
 _SEVERITY_RANK = {"CRITICAL": 0, "HIGH": 1, "MEDIUM": 2, "LOW": 3}
 
 # GitHub code-scanning uses a numeric security-severity (CVSS-like) to bucket
@@ -35,21 +36,10 @@
 _TOOL_URI = "https://github.com/azmolhaque/secretnode"
 
 
-def _tool_version() -> str:
-    """Single-source the version from pyproject.toml so client reports never stamp
-    a stale version (they used to be pinned at 2.3.0). Falls back if unreadable."""
-    try:
-        pyproject = Path(__file__).resolve().parent.parent / "pyproject.toml"
-        for line in pyproject.read_text(encoding="utf-8").splitlines():
-            s = line.strip()
-            if s.startswith("version") and "=" in s:
-                return s.split("=", 1)[1].strip().strip('"').strip("'")
-    except Exception:
-        pass
-    return "2.7.9"
-
-
-_TOOL_VERSION = _tool_version()
+# Version comes from the shared module so reports, the API banner and the
+# Discord alerter can never disagree about which build produced a finding.
+_tool_version = version.read_version
+_TOOL_VERSION = version.TOOL_VERSION
 
 
 def _severity_of(finding: dict[str, Any]) -> str:
@@ -68,17 +58,29 @@ def _severity_of(finding: dict[str, Any]) -> str:
 REPORT_FULL_SECRETS = os.environ.get("REPORT_FULL_SECRETS", "false").lower() == "true"
 
 
-def redact_secret(value: str) -> str:
-    """Mask the middle of a credential, keeping enough to identify it."""
+def mask_secret(value: str) -> str:
+    """Mask the middle of a credential, keeping enough to identify it.
+
+    Unconditional — no opt-out. Use this for any surface an operator did not
+    deliberately ask for the full value on (the dashboard, WebSocket events,
+    anything that leaves the process without passing through report generation).
+    """
     if not value:
         return ""
-    if REPORT_FULL_SECRETS:
-        return value
     if len(value) <= 12:
         return "*" * len(value)
     return f"{value[:6]}…{'*' * 6}…{value[-4:]}  ({len(value)} chars)"
 
 
+def redact_secret(value: str) -> str:
+    """Report-facing mask. Honours the REPORT_FULL_SECRETS opt-in, which exists
+    so an operator handing a key to the client's engineer for rotation can
+    produce one report containing it — a deliberate, per-deployment decision."""
+    if REPORT_FULL_SECRETS:
+        return value
+    return mask_secret(value)
+
+
 def _sort_key(finding: dict[str, Any]) -> tuple[int, int, str]:
     """Sort by severity (critical first), then AI confidence (high first),
     then secret type for stable ordering."""
@@ -102,7 +104,13 @@ def generate_html_report(scan: dict[str, Any], agency_name: str = "Independent S
     new_count = scan.get("new_findings_count", len(confirmed))
     recurring_count = scan.get("recurring_findings_count", 0)
     duration = scan.get("duration_seconds", 0)
-    assets = scan.get("assets_fetched", 0)
+    # Coverage, not downloads. A re-scan where nothing changed downloads zero
+    # bodies but still accounts for every asset; reporting the download count
+    # would tell the client we scanned nothing. Falls back to assets_fetched for
+    # scan records written before the cache counters existed.
+    fetched = int(scan.get("assets_fetched", 0) or 0)
+    cached = int(scan.get("assets_cached", 0) or 0)
+    assets = int(scan.get("assets_scanned", 0) or 0) or (fetched + cached)
 
     sev_counts: dict[str, int] = {"CRITICAL": 0, "HIGH": 0, "MEDIUM": 0, "LOW": 0}
     for f in confirmed:
@@ -339,7 +347,7 @@ def _posture_row(p: dict[str, Any]) -> str:
     <div><b>Scan started</b> {scanned_at}</div>
     <div><b>Report generated</b> {generated_at}</div>
     <div><b>Scan duration</b> {duration}s</div>
-    <div><b>Assets analysed</b> {assets}</div>
+    <div><b>Assets analysed</b> {assets}{f' ({cached} unchanged since the previous scan)' if cached else ''}</div>
     <div><b>Candidates screened</b> {raw_screened}</div>
   </div>
 
@@ -406,6 +414,30 @@ def _posture_row(p: dict[str, Any]) -> str:
 </html>"""
 
 
+# ─────────────────────────────────────────────────────────────────────────────
+# JSON
+# ─────────────────────────────────────────────────────────────────────────────
+
+def generate_json_report(scan: dict[str, Any]) -> dict[str, Any]:
+    """The raw scan record, with credentials masked the same way every other
+    report format masks them.
+
+    The JSON export used to hand back the stored record verbatim, which made it
+    the one deliverable format that still contained live keys — the same file a
+    client is most likely to pipe into another tool or commit to a triage repo.
+    """
+    out = dict(scan)
+    for key in ("confirmed_findings", "needs_review_findings"):
+        findings = out.get(key)
+        if isinstance(findings, list):
+            out[key] = [
+                {**f, "raw_match": redact_secret(str(f.get("raw_match", "")))}
+                if isinstance(f, dict) and f.get("raw_match") else f
+                for f in findings
+            ]
+    return out
+
+
 # ─────────────────────────────────────────────────────────────────────────────
 # CSV
 # ─────────────────────────────────────────────────────────────────────────────
@@ -554,6 +586,13 @@ def generate_sarif_report(scan: dict[str, Any]) -> str:
                 "verified": verified,
                 "verified_detail": verified_detail,
                 "impact": impact,
+                # Same redacted value the CSV carries, so a triager can
+                # correlate a SARIF result with the spreadsheet row and the
+                # Discord alert without going back to the raw scan record.
+                "matched_value_partial": redact_secret(str(f.get("raw_match", "") or "")),
+                "found_at": str(f.get("found_at", "") or ""),
+                # Present only on deep scans: which host in the domain served it.
+                **({"host": str(f["_host"])} if f.get("_host") else {}),
                 "status": "needs_review" if is_review else "confirmed",
             },
         })
@@ -575,6 +614,17 @@ def generate_sarif_report(scan: dict[str, Any]) -> str:
                 "target_url": scan.get("target_url", ""),
                 "scan_id": scan.get("scan_id", ""),
                 "assets_fetched": scan.get("assets_fetched", 0),
+                "assets_cached": scan.get("assets_cached", 0),
+                "assets_scanned": (scan.get("assets_scanned", 0)
+                                   or scan.get("assets_fetched", 0)),
+                "raw_findings_screened": scan.get("raw_findings", 0),
+                "duration_seconds": scan.get("duration_seconds", 0),
+                "deep_scan": bool(scan.get("deep_scan")),
+                # Coverage a reader needs to judge what a clean result means.
+                **({"hosts_scanned": scan.get("totals", {}).get("hosts_scanned", 0),
+                    "live_hosts": scan.get("totals", {}).get("live_hosts", 0)}
+                   if scan.get("deep_scan") else {}),
+                "generated_at": datetime.now(timezone.utc).isoformat(),
             },
         }],
     }
@@ -635,13 +685,19 @@ def _loc(f: dict[str, Any]) -> str:
         return html.escape(str(f.get("source_url", f.get("target_url", ""))))
 
     def conf_row(f: dict[str, Any]) -> str:
+        verified = str(f.get("verified", "")).lower()
+        vbadge = ('<span class="sev sev-critical">VERIFIED ACTIVE</span>'
+                  if verified == "verified" else html.escape(verified or "—"))
+        impact = str(f.get("impact", "") or "")
         return ("<tr>"
                 f'<td class="mono">{html.escape(str(f.get("_host", "")))}</td>'
                 f"<td>{_sev(f)}</td>"
                 f'<td>{html.escape(str(f.get("secret_type", "")))}</td>'
                 f'<td class="mono small">{_loc(f)}</td>'
+                f'<td class="mono small">{html.escape(redact_secret(str(f.get("raw_match", "") or "")))}</td>'
                 f'<td style="text-align:center;">{int(f.get("confidence", 0) or 0)}%</td>'
-                f'<td class="small">{html.escape(str(f.get("reason", "")))}</td>'
+                f'<td class="small">{vbadge}</td>'
+                f'<td class="small">{html.escape(impact) if impact else html.escape(str(f.get("reason", "")))}</td>'
                 "</tr>")
 
     def review_row(f: dict[str, Any]) -> str:
@@ -654,7 +710,7 @@ def review_row(f: dict[str, Any]) -> str:
                 "</tr>")
 
     conf_rows = "\n".join(conf_row(f) for f in confirmed_findings) or \
-        '<tr><td colspan="6" class="empty">No confirmed credential exposures.</td></tr>'
+        '<tr><td colspan="8" class="empty">No confirmed credential exposures.</td></tr>'
     review_rows = "\n".join(review_row(f) for f in review_findings) or \
         '<tr><td colspan="5" class="empty">None.</td></tr>'
     assoc_hosts_html = ", ".join(html.escape(h) for h in deep.get("associated_hosts", [])) or "—"
@@ -719,6 +775,7 @@ def takeover_row(t: dict[str, Any]) -> str:
     <div class="stat"><div class="num">{int(totals.get('subdomains', 0))}</div><div class="label">Subdomains found</div></div>
     <div class="stat"><div class="num">{int(totals.get('live_hosts', 0))}</div><div class="label">Live hosts</div></div>
     <div class="stat"><div class="num">{int(totals.get('hosts_scanned', 0))}</div><div class="label">Hosts scanned</div></div>
+    <div class="stat"><div class="num">{int(totals.get('assets_scanned', deep.get('assets_scanned', 0)) or totals.get('assets_fetched', 0) or 0)}</div><div class="label">Assets analysed</div></div>
     <div class="stat"><div class="num">{int(totals.get('historical_urls', 0))}</div><div class="label">Historical URLs</div></div>
     <div class="stat"><div class="num">{confirmed_total}</div><div class="label">Confirmed exposures</div></div>
     <div class="stat"><div class="num">{int(totals.get('needs_review', 0))}</div><div class="label">Needs review</div></div>
@@ -742,8 +799,12 @@ def takeover_row(t: dict[str, Any]) -> str:
   </table>
 
   <h2>Confirmed Findings (all hosts)</h2>
+  <div class="small" style="margin-bottom:6px;">Matched values are redacted — enough of each
+  credential is shown to identify which key to rotate, never enough to use it. The same value
+  appearing on more than one host is a single credential shared across environments: rotate it once,
+  then remove it from every build config listed.</div>
   <table>
-    <thead><tr><th>Host</th><th>Severity</th><th>Type</th><th>Location</th><th>Confidence</th><th>AI Reasoning</th></tr></thead>
+    <thead><tr><th>Host</th><th>Severity</th><th>Type</th><th>Location</th><th>Matched value (redacted)</th><th>Confidence</th><th>Verified</th><th>Impact</th></tr></thead>
     <tbody>{conf_rows}</tbody>
   </table>
 
diff --git a/backend/scanner.py b/backend/scanner.py
index 526b358..1736549 100644
--- a/backend/scanner.py
+++ b/backend/scanner.py
@@ -31,6 +31,7 @@
 import posture
 import surface
 import verifier
+import version
 
 logger = logging.getLogger("secretnode.scanner")
 
@@ -205,14 +206,23 @@ def effective_severity(self) -> str:
         return self._meta().severity
 
     def to_dict(self) -> dict[str, Any]:
+        # The surrounding code snippet is masked here, at the point the finding
+        # leaves the dataclass, because every consumer of this dict is a place
+        # the credential must not appear verbatim: the dashboard renders it in
+        # the finding-detail modal, the JSON export writes it to a file the
+        # client keeps, and SQLite persists it. Masking downstream is not
+        # equivalent — only here is the *full* raw value still available to
+        # match against, so a snippet holding a >80-char secret still gets
+        # fully masked rather than partially.
+        raw_value = self.raw.raw_match
         return {
             "fingerprint":    self.raw.fingerprint,
             "scan_id":        self.raw.scan_id,
             "target_url":     self.raw.target_url,
             "source_url":     self.raw.source_url,
             "secret_type":    self.raw.secret_type,
-            "raw_match":      self.raw.raw_match[:80] + "…" if len(self.raw.raw_match) > 80 else self.raw.raw_match,
-            "context_snippet": self.raw.context_snippet[:400],
+            "raw_match":      raw_value[:80] + "…" if len(raw_value) > 80 else raw_value,
+            "context_snippet": redact_snippet(self.raw.context_snippet, raw_value)[:400],
             "entropy":        self.raw.entropy,
             "is_valid":       self.is_valid,
             "confidence":     self.confidence,
@@ -842,12 +852,25 @@ async def _throttle_wait(host: str) -> None:
 _asset_cache_in: dict[str, dict[str, Any]] = {}
 _asset_cache_out: dict[str, dict[str, Any]] = {}
 
+# URLs the server confirmed unchanged and that were clean last time, so no body
+# was re-downloaded. They are still *covered* by the scan — the tool checked
+# them and knows their content has not changed — but they never enter the asset
+# list, so counting only downloads makes a fully-cached re-scan report
+# "0 assets", which reads to a client as "nothing was scanned".
+_asset_cache_hits: set[str] = set()
+
 
 def load_asset_cache(entries: dict[str, dict[str, Any]]) -> None:
     """Prime the conditional-GET cache for a scan."""
     _asset_cache_in.clear()
     _asset_cache_in.update(entries or {})
     _asset_cache_out.clear()
+    _asset_cache_hits.clear()
+
+
+def cached_clean_count() -> int:
+    """How many assets this scan skipped as unchanged-and-previously-clean."""
+    return len(_asset_cache_hits)
 
 
 def drain_asset_cache() -> dict[str, dict[str, Any]]:
@@ -985,6 +1008,7 @@ async def fetch_url(
     broadcast: Broadcaster | None = None,
     cache: dict[str, dict[str, Any]] | None = None,
     cache_out: dict[str, dict[str, Any]] | None = None,
+    allow_cache_skip: bool = True,
 ) -> tuple[str, str | None]:
     """
     Fetch a URL with retry + exponential backoff.
@@ -993,6 +1017,14 @@ async def fetch_url(
     (401/403/406/429/503) we retry with a different browser fingerprint before
     giving up, and emit a diagnostic that names the likely cause instead of a
     bare "failed". Respects 429 Retry-After. Returns (url, body) or (url, None).
+
+    `allow_cache_skip=False` still sends the conditional GET and still records
+    the validators, but never returns CACHED_CLEAN — the caller gets a real
+    body. Crawled HTML pages must use it: a page is a link graph, not just
+    something to grep. Skipping an unchanged page's body means never parsing
+    its <script> tags, so every JS bundle it references drops out of the scan.
+    That turns a re-scan of an unchanged site into a false all-clear, which is
+    a far worse failure than re-downloading a few kilobytes of HTML.
     """
     host = urlparse(url).netloc
     async with semaphore:
@@ -1033,9 +1065,10 @@ async def fetch_url(
 
                 if response.status_code == 304:
                     _throttle_reward(host)
-                    if entry and entry.get("was_clean", True):
+                    if entry and entry.get("was_clean", True) and allow_cache_skip:
                         # Unchanged and previously clean -> nothing to re-scan.
                         _cout[url] = dict(entry)
+                        _asset_cache_hits.add(url)
                         return url, CACHED_CLEAN
                     # Either the asset yielded a finding last time, or the server
                     # sent 304 unprompted. Both need the body: a finding that
@@ -1503,7 +1536,10 @@ async def spider_target(
 
     await check_robots_txt(client, target_url, broadcast)
 
-    root_url, html_body = await fetch_url(client, target_url, semaphore, broadcast)
+    # allow_cache_skip=False: we need the root's body to discover assets, even
+    # when the server says it has not changed.
+    root_url, html_body = await fetch_url(client, target_url, semaphore, broadcast,
+                                          allow_cache_skip=False)
     if html_body is None:
         if broadcast:
             await broadcast({
@@ -1530,7 +1566,8 @@ async def spider_target(
         while queue and len(visited_pages) < max_pages:
             batch = queue[: max_pages - len(visited_pages)]
             queue = queue[len(batch):]
-            fetch_tasks = [fetch_url(client, u, semaphore, broadcast) for u in batch]
+            fetch_tasks = [fetch_url(client, u, semaphore, broadcast,
+                                     allow_cache_skip=False) for u in batch]
             fetched_pages = await asyncio.gather(*fetch_tasks, return_exceptions=False)
             for page_url, page_body in fetched_pages:
                 visited_pages.add(page_url)
@@ -2061,23 +2098,18 @@ async def validate_with_gemini(
 # Discord Webhook Dispatcher
 # ─────────────────────────────────────────────────────────────────────────────
 
+# Embed accent colour, keyed on the finding's *effective* severity rather than
+# on its type name. The previous per-type table listed 16 of the registry's 60+
+# detectors, so every newer pattern (the whole AI/ML provider family included)
+# silently fell through to the CRITICAL red — an ElevenLabs key and an AWS root
+# key arrived in Discord looking identical. Severity already comes from the
+# pattern registry and accounts for the public-by-design downgrade, so use it.
 _SEVERITY_COLORS: dict[str, int] = {
-    "AWS Access Key":              0xE53E3E,
-    "AWS Secret Access Key":       0xE53E3E,
-    "GitHub Personal Access Token":0xE53E3E,
-    "Stripe Secret Key":           0xE53E3E,
-    "Private Key Block":           0xE53E3E,
-    "Google Cloud API Key":        0xDD6B20,
-    "GitHub OAuth Token":          0xDD6B20,
-    "Slack Webhook":               0xD69E2E,
-    "SendGrid API Key":            0xDD6B20,
-    "Twilio Auth Token":           0xDD6B20,
-    "Heroku API Key":              0xDD6B20,
-    "Shopify Access Token":        0xDD6B20,
-    "Mailgun API Key":             0xDD6B20,
-    "JWT Token":                   0xD69E2E,
-    "Stripe Publishable Key":      0x3182CE,
-    "Generic High-Entropy Secret": 0xD69E2E,
+    "CRITICAL": 0xE53E3E,
+    "HIGH":     0xDD6B20,
+    "MEDIUM":   0xD69E2E,
+    "LOW":      0x3182CE,
+    "INFO":     0x63B3ED,
 }
 
 # secret_type name -> severity, sourced directly from the pattern registry
@@ -2095,7 +2127,7 @@ async def dispatch_discord(
         return False
 
     raw = finding.raw
-    color = _SEVERITY_COLORS.get(raw.secret_type, 0xE53E3E)
+    color = _SEVERITY_COLORS.get(finding.effective_severity(), 0xD69E2E)
     safe_snippet_full = redact_snippet(raw.context_snippet, raw.raw_match)
     snippet = (
         safe_snippet_full[:900] + "…"
@@ -2105,17 +2137,18 @@ async def dispatch_discord(
     redacted = redact_secret(raw.raw_match)
 
     payload = {
-        "username": "SecretNode v2.4.0",
+        "username": f"SecretNode v{version.TOOL_VERSION}",
         "avatar_url": "https://cdn-icons-png.flaticon.com/512/2092/2092757.png",
         "embeds": [{
             "title": f"🚨 Secret Exposed: {raw.secret_type}",
             "color": color,
             "timestamp": datetime.now(timezone.utc).isoformat(),
-            "footer": {"text": "SecretNode v2.4.0 — ASM Scanner"},
+            "footer": {"text": f"SecretNode v{version.TOOL_VERSION} — ASM Scanner"},
             "fields": [
                 {"name": "🎯 Target",        "value": f"`{raw.target_url}`",      "inline": False},
                 {"name": "📄 Source Asset",  "value": f"`{raw.source_url}`",      "inline": False},
                 {"name": "🔑 Secret Type",   "value": raw.secret_type,            "inline": True},
+                {"name": "⚠️ Severity",      "value": finding.effective_severity(), "inline": True},
                 {"name": "📊 Entropy",       "value": f"`{raw.entropy:.2f} bits`","inline": True},
                 {"name": "🤖 AI Confidence", "value": f"`{finding.confidence}%`", "inline": True},
                 {"name": "💬 AI Reasoning",  "value": finding.reason[:1000],      "inline": False},
@@ -2238,6 +2271,13 @@ async def run_scan(
     # Pacing learned from a previous target must not penalise this one.
     reset_throttle()
 
+    # Likewise the cache-hit tally. It is module state (see _asset_cache_in), so
+    # without this a scan that never primes the cache — every deep-scan host
+    # takes that path — inherits the previous scan's count and reports assets it
+    # never looked at. Only the tally is cleared: `load_asset_cache()` runs
+    # before this and its priming must survive.
+    _asset_cache_hits.clear()
+
     async def emit(event: dict[str, Any]) -> None:
         if broadcast:
             await broadcast(event)
@@ -2250,7 +2290,9 @@ async def emit(event: dict[str, Any]) -> None:
         "scan_id":             scan_id,
         "target_url":         target_url,
         "status":             "running",
-        "assets_fetched":     0,
+        "assets_fetched":     0,   # bodies downloaded this run
+        "assets_cached":      0,   # skipped: unchanged since last scan and clean then
+        "assets_scanned":     0,   # total coverage = fetched + cached
         "raw_findings":       0,
         "validated_findings": 0,
         "confirmed_findings": [],
@@ -2353,10 +2395,21 @@ async def emit(event: dict[str, Any]) -> None:
                                 f"{len(result['associated_hosts'])} associated host(s)"),
                 })
 
+        # Three distinct numbers, because conflating them misreports coverage:
+        #   assets_fetched — bodies actually downloaded this run
+        #   assets_cached  — unchanged since last scan and clean then, so skipped
+        #   assets_scanned — total coverage, and the number a report should lead
+        #                    with. A fully-cached re-scan downloads nothing; saying
+        #                    "0 assets" would describe that as having scanned
+        #                    nothing, when in fact every asset was accounted for.
+        cached = cached_clean_count()
         result["assets_fetched"] = len(assets)
+        result["assets_cached"] = cached
+        result["assets_scanned"] = len(assets) + cached
         await emit({
             "type": "log", "level": "INFO",
-            "message": f"Asset collection complete — {len(assets)} files to scan",
+            "message": (f"Asset collection complete — {len(assets)} file(s) to scan"
+                        + (f", {cached} unchanged since last scan (cached)" if cached else "")),
         })
 
         # ── 1b. Passive security-posture check (R8) ─────────────────────────
diff --git a/backend/tests/test_v280.py b/backend/tests/test_v280.py
new file mode 100644
index 0000000..cb6236a
--- /dev/null
+++ b/backend/tests/test_v280.py
@@ -0,0 +1,516 @@
+"""
+v2.8.0 — the credential stops at the API boundary, and the dashboard stops
+disagreeing with the reports.
+
+Everything here was found by analysing the artifacts of a real v2.7.9 deep scan
+side by side: the CSV showed a properly redacted value, the Discord alert showed
+a redacted value and a "v2.4.0" footer, and the dashboard modal — under a
+heading that read "MATCHED VALUE (PARTIAL)" — showed the whole key, with a
+MEDIUM badge next to a finding the SARIF and CSV both called HIGH. The SARIF
+claimed `assets_fetched: 0` for a run that had crawled 25 hosts.
+
+Four separate presentation-layer bugs, one root cause each. The tests below pin
+each one so the formats can never drift apart again.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import re
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import orchestrator  # noqa: E402
+import report  # noqa: E402
+import scanner  # noqa: E402
+import version  # noqa: E402
+
+# 52 characters, the shape of a real ElevenLabs key. Deliberately longer than
+# the 60-character slice the old dashboard applied, which is exactly why that
+# slice never truncated anything.
+FAKE_KEY = "sk_" + "0123456789abcdef" * 3 + "beef"
+
+FRONTEND = Path(__file__).resolve().parent.parent.parent / "frontend" / "index.html"
+
+
+class FakeResponse:
+    """Minimal stand-in for httpx.Response, matching what fetch_url touches."""
+
+    def __init__(self, status_code=200, text="", headers=None):
+        self.status_code = status_code
+        self.text = text
+        self.headers = headers or {}
+
+    def raise_for_status(self):
+        pass
+
+
+def _finding(**over):
+    raw = scanner.RawFinding(
+        scan_id="scan-1",
+        target_url="https://aiq.dev.example.com",
+        source_url="https://aiq.dev.example.com/EnvConfig.js",
+        secret_type=over.pop("secret_type", "ElevenLabs API Key"),
+        raw_match=over.pop("raw_match", FAKE_KEY),
+        context_snippet=over.pop("snippet", f'window.ENV={{"TTS":"{FAKE_KEY}"}};'),
+        entropy=4.6,
+    )
+    return scanner.ValidatedFinding(
+        raw=raw, is_valid=True, confidence=95,
+        reason="Hardcoded provider secret in client-side code.",
+        impact="An attacker can consume the account's synthesis quota.",
+        **over,
+    )
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 1. The credential must not reach a browser
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_finding_dict_masks_the_surrounding_code_snippet():
+    """The modal renders `context_snippet` verbatim. It used to contain the key."""
+    d = _finding().to_dict()
+    assert FAKE_KEY not in d["context_snippet"]
+    assert "sk_012" in d["context_snippet"], "prefix should survive for identification"
+
+
+def test_snippet_masking_uses_the_full_value_not_the_truncated_one():
+    """`raw_match` is capped at 80 chars in the dict. If the snippet were masked
+    downstream from that capped value, a 100-char secret would leave its tail
+    exposed. Masking happens where the full value is still available."""
+    long_key = "x" * 100
+    d = _finding(raw_match=long_key, snippet=f'const k = "{long_key}";').to_dict()
+    assert long_key not in d["context_snippet"]
+    assert d["raw_match"].endswith("…"), "raw_match is still capped"
+
+
+def test_public_finding_masks_raw_match_without_mutating_the_record():
+    import main
+
+    stored = _finding().to_dict()
+    public = main.public_finding(stored)
+
+    assert FAKE_KEY not in public["raw_match"]
+    assert public["raw_match"].startswith("sk_012")
+    # Storage keeps the real value — reports and the suppression fingerprint need it.
+    assert stored["raw_match"] == FAKE_KEY
+
+
+def test_public_scan_masks_both_finding_lists():
+    import main
+
+    scan = {
+        "confirmed_findings": [_finding().to_dict()],
+        "needs_review_findings": [_finding().to_dict()],
+    }
+    public = main.public_scan(scan)
+    for key in ("confirmed_findings", "needs_review_findings"):
+        assert FAKE_KEY not in json.dumps(public[key])
+
+
+def test_public_event_masks_live_findings_and_leaves_logs_alone():
+    import main
+
+    ev = main.public_event({"type": "finding", "data": _finding().to_dict()})
+    assert FAKE_KEY not in ev["data"]["raw_match"]
+
+    log = {"type": "log", "level": "INFO", "message": "crawling"}
+    assert main.public_event(log) == log
+
+
+def test_public_event_masks_the_scan_complete_result():
+    """`scan_complete` ships the entire result dict — both finding lists — in the
+    final WebSocket frame of every scan. Scrubbing only the per-finding events
+    left that frame carrying the unmasked set."""
+    import main
+
+    result = {
+        "scan_id": "s", "status": "complete",
+        "confirmed_findings": [_finding().to_dict()],
+        "needs_review_findings": [_finding().to_dict()],
+    }
+    ev = main.public_event({"type": "scan_complete", "scan_id": "s", "result": result})
+    assert FAKE_KEY not in json.dumps(ev)
+    assert result["confirmed_findings"][0]["raw_match"] == FAKE_KEY, "registry copy untouched"
+
+
+def test_mask_secret_ignores_the_report_full_secrets_opt_in(monkeypatch):
+    """REPORT_FULL_SECRETS exists so an operator can produce one report holding
+    the real value. It must not also unmask every dashboard session."""
+    monkeypatch.setattr(report, "REPORT_FULL_SECRETS", True)
+    assert report.redact_secret(FAKE_KEY) == FAKE_KEY      # report path opts in
+    assert report.mask_secret(FAKE_KEY) != FAKE_KEY        # boundary path never does
+
+
+def test_json_report_masks_the_credential():
+    """HTML, CSV and SARIF all redacted; the JSON export handed back the record
+    verbatim, making it the one leaking deliverable."""
+    scan = {"scan_id": "s", "confirmed_findings": [_finding().to_dict()]}
+    out = report.generate_json_report(scan)
+    assert FAKE_KEY not in json.dumps(out)
+    assert scan["confirmed_findings"][0]["raw_match"] == FAKE_KEY
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 2. One severity, computed once, on the server
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_ai_provider_keys_are_high_not_medium():
+    assert _finding().to_dict()["severity"] == "HIGH"
+
+
+def test_frontend_does_not_re_derive_severity_from_a_hardcoded_type_list():
+    html = FRONTEND.read_text(encoding="utf-8")
+    assert "severityFromType" not in html, (
+        "the dashboard must read the server's `severity` field; re-deriving it "
+        "from a list of type names silently defaults every newer detector to MEDIUM"
+    )
+    assert "function severityOf(" in html
+
+
+def test_frontend_has_a_badge_style_for_every_severity_the_backend_emits():
+    html = FRONTEND.read_text(encoding="utf-8")
+    emitted = {p.severity.upper() for p in scanner.SECRET_PATTERNS} | {"INFO"}
+    for sev in emitted:
+        assert f".badge-{sev.lower()}" in html, f"no badge style for {sev}"
+
+
+def test_frontend_modal_masks_and_labels_honestly():
+    html = FRONTEND.read_text(encoding="utf-8")
+    assert "MATCHED VALUE (PARTIAL)" not in html, "the label claimed a truncation that never happened"
+    assert "MATCHED VALUE (REDACTED)" in html
+    assert "maskSecret(f.raw_match)" in html
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 3. One version string
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_version_is_single_sourced_from_pyproject():
+    pyproject = Path(__file__).resolve().parent.parent.parent / "pyproject.toml"
+    declared = next(
+        line.split("=", 1)[1].strip().strip('"')
+        for line in pyproject.read_text(encoding="utf-8").splitlines()
+        if line.strip().startswith("version")
+    )
+    assert version.TOOL_VERSION == declared
+    assert report._TOOL_VERSION == declared
+
+
+def test_no_module_hardcodes_a_version_literal():
+    """The Discord alerter announced "v2.4.0" for five releases because nothing
+    breaks when a hardcoded version goes stale."""
+    backend = Path(__file__).resolve().parent.parent
+    pattern = re.compile(r"SecretNode v\d+\.\d+\.\d+")
+    offenders = []
+    for path in backend.glob("*.py"):
+        for n, line in enumerate(path.read_text(encoding="utf-8").splitlines(), 1):
+            if pattern.search(line):
+                offenders.append(f"{path.name}:{n}: {line.strip()}")
+    assert not offenders, "hardcoded version literals: " + "; ".join(offenders)
+
+
+@pytest.mark.asyncio
+async def test_discord_payload_carries_the_live_version_and_severity(monkeypatch):
+    import httpx
+
+    monkeypatch.setattr(scanner, "DISCORD_WEBHOOK_URL", "https://discord.test/hook")
+    sent: dict = {}
+
+    class _Resp:
+        status_code = 204
+        text = ""
+
+    class _Client:
+        async def post(self, url, json=None, **kw):
+            sent.update(json or {})
+            return _Resp()
+
+    import asyncio
+    ok = await scanner.dispatch_discord(_Client(), _finding(), asyncio.Semaphore(1))
+    assert ok
+    assert sent["username"] == f"SecretNode v{version.TOOL_VERSION}"
+    assert sent["embeds"][0]["footer"]["text"].startswith(f"SecretNode v{version.TOOL_VERSION}")
+
+    fields = {f["name"]: f["value"] for f in sent["embeds"][0]["fields"]}
+    assert any("Severity" in name for name in fields), "alert should state the severity"
+    assert FAKE_KEY not in json.dumps(sent), "no field may carry the live key"
+    # HIGH, not the old catch-all CRITICAL red.
+    assert sent["embeds"][0]["color"] == scanner._SEVERITY_COLORS["HIGH"]
+    assert httpx  # imported for parity with the module under test
+
+
+def test_discord_colour_is_keyed_on_severity_not_type():
+    """The old per-type table listed 16 of 60+ detectors; everything else fell
+    through to the CRITICAL red, so an ElevenLabs key looked like an AWS root key."""
+    assert set(scanner._SEVERITY_COLORS) >= {"CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"}
+    assert scanner._SEVERITY_COLORS["HIGH"] != scanner._SEVERITY_COLORS["CRITICAL"]
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 4. Deep-scan metrics survive aggregation
+# ─────────────────────────────────────────────────────────────────────────────
+
+def _deep_result():
+    scan_a = {
+        "target_url": "https://a.example.com", "assets_fetched": 7, "raw_findings": 4,
+        "validated_findings": 2, "verified_count": 0, "unverified_count": 1,
+        "confirmed_findings": [_finding().to_dict()], "needs_review_findings": [],
+        "posture_findings": [{"issue": "missing HSTS", "severity": "LOW"}],
+    }
+    scan_b = {
+        "target_url": "https://b.example.com", "assets_fetched": 5, "raw_findings": 1,
+        "validated_findings": 0, "confirmed_findings": [], "needs_review_findings": [],
+        "posture_findings": [],
+    }
+    d = orchestrator.DeepScanResult(domain="example.com")
+    d.hosts = [
+        orchestrator.HostScan(host="a.example.com", url="https://a.example.com",
+                              confirmed=1, assets=7, posture_issues=1),
+        orchestrator.HostScan(host="b.example.com", url="https://b.example.com", assets=5),
+    ]
+    d.scans = [scan_a, scan_b]
+    d.duration_seconds = 41.7
+    return d
+
+
+def test_deep_scan_rolls_up_assets_fetched():
+    """A 25-host run reported `assets_fetched: 0` because DeepScanResult.to_dict()
+    simply had no such key and report.py fell back to its default."""
+    dd = _deep_result().to_dict()
+    assert dd["assets_fetched"] == 12
+    assert dd["totals"]["assets_fetched"] == 12
+
+
+def test_deep_scan_rolls_up_the_screening_funnel():
+    dd = _deep_result().to_dict()
+    assert dd["raw_findings"] == 5
+    assert dd["validated_findings"] == 2
+    assert dd["unverified_count"] == 1
+
+
+def test_deep_scan_duration_is_wall_clock_not_a_sum_of_concurrent_hosts():
+    dd = _deep_result().to_dict()
+    assert dd["duration_seconds"] == 41.7
+
+
+def test_deep_scan_aggregates_posture_findings_with_host_provenance():
+    dd = _deep_result().to_dict()
+    assert len(dd["posture_findings"]) == 1
+    assert dd["posture_findings"][0]["_host"] == "a.example.com"
+
+
+def test_deep_scan_sarif_reports_real_coverage():
+    dd = _deep_result().to_dict()
+    dd.update({"scan_id": "s", "target_url": "example.com", "deep_scan": True})
+    props = json.loads(report.generate_sarif_report(dd))["runs"][0]["properties"]
+    assert props["assets_fetched"] == 12
+    assert props["raw_findings_screened"] == 5
+    assert props["hosts_scanned"] == 2
+    assert props["deep_scan"] is True
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 5. Every format shows the same evidence
+# ─────────────────────────────────────────────────────────────────────────────
+
+def test_deep_scan_html_shows_the_redacted_matched_value():
+    """CSV and SARIF both carried `matched_value_partial`; the deep-scan HTML —
+    the format a client actually reads — dropped it entirely, so there was no
+    way to correlate a finding back to a key."""
+    dd = _deep_result().to_dict()
+    html = report.generate_deep_scan_html(dd)
+    assert "Matched value (redacted)" in html
+    assert report.redact_secret(FAKE_KEY) in html
+    assert FAKE_KEY not in html
+
+
+def test_deep_scan_html_shows_asset_coverage():
+    html = report.generate_deep_scan_html(_deep_result().to_dict())
+    assert "Assets analysed" in html
+
+
+def test_sarif_results_carry_the_same_redacted_value_as_the_csv():
+    dd = _deep_result().to_dict()
+    dd.update({"scan_id": "s", "target_url": "example.com", "deep_scan": True})
+    sarif = json.loads(report.generate_sarif_report(dd))
+    csv_out = report.generate_csv_report(dd)
+
+    result = sarif["runs"][0]["results"][0]
+    masked = report.redact_secret(FAKE_KEY)
+    assert result["properties"]["matched_value_partial"] == masked
+    assert masked in csv_out
+    assert result["properties"]["host"] == "a.example.com"
+    assert FAKE_KEY not in json.dumps(sarif)
+    assert FAKE_KEY not in csv_out
+
+
+def test_no_export_format_leaks_the_credential():
+    """The single guard that matters: whatever the format, the key is not in it."""
+    dd = _deep_result().to_dict()
+    dd.update({"scan_id": "s", "target_url": "example.com", "deep_scan": True,
+               "status": "complete"})
+    bodies = [
+        report.generate_deep_scan_html(dd),
+        report.generate_csv_report(dd),
+        report.generate_sarif_report(dd),
+        json.dumps(report.generate_json_report(dd)),
+        report.generate_html_report(dd),
+    ]
+    for body in bodies:
+        assert FAKE_KEY not in body
+
+
+def test_mutation_check_the_leak_guard_can_actually_fail(monkeypatch):
+    """A redaction test that passes when redaction is switched off is testing
+    nothing. Disable the mask and prove the guard trips."""
+    monkeypatch.setattr(report, "REPORT_FULL_SECRETS", True)
+    dd = _deep_result().to_dict()
+    dd.update({"scan_id": "s", "target_url": "example.com", "deep_scan": True})
+    assert FAKE_KEY in report.generate_csv_report(dd)
+    assert FAKE_KEY in report.generate_deep_scan_html(dd)
+
+
+# ─────────────────────────────────────────────────────────────────────────────
+# 6. A cached re-scan is not a scan of nothing
+# ─────────────────────────────────────────────────────────────────────────────
+#
+# Found while reproducing the deep-scan metric bug on a local lab target: the
+# second scan of an unchanged host reported `assets_fetched: 0`. That is
+# literally true — the conditional GET returned 304 and no body was downloaded —
+# but it is the wrong number to put in a client report, where "0 assets
+# analysed" reads as "we scanned nothing" rather than "nothing had changed".
+
+def test_cached_clean_assets_are_counted_as_coverage():
+    scanner.load_asset_cache({})
+    scanner._asset_cache_hits.update({"https://x/a.js", "https://x/b.js"})
+    assert scanner.cached_clean_count() == 2
+    scanner.load_asset_cache({})
+    assert scanner.cached_clean_count() == 0, "priming a new scan must reset the counter"
+
+
+@pytest.mark.asyncio
+async def test_an_unchanged_page_still_yields_its_body_so_assets_stay_discoverable():
+    """The false all-clear.
+
+    Re-scanning an unchanged site returned 304 for the root page. The cache
+    treated that as "clean, skip", so the root's body never came back, its
+    <script> tags were never parsed, and the JS bundle holding a live key was
+    never even requested — the re-scan reported CLEAN while the credential was
+    still exposed. A page is a link graph; its body is required regardless.
+    """
+    import asyncio
+
+    page = '<html><body><script src="/app.js"></script></body></html>'
+    requested: list[tuple[str, bool]] = []
+
+    class _Client:
+        async def get(self, url, headers=None, **kw):
+            conditional = bool(headers and "If-None-Match" in headers)
+            requested.append((url, conditional))
+            # Server says "unchanged" whenever we revalidate.
+            return FakeResponse(304) if conditional else FakeResponse(200, page, {"etag": '"v1"'})
+
+    scanner.load_asset_cache({"https://x.example": {"etag": '"v1"', "was_clean": True}})
+    try:
+        url, body = await scanner.fetch_url(
+            _Client(), "https://x.example", asyncio.Semaphore(1),
+            allow_cache_skip=False,
+        )
+    finally:
+        scanner.load_asset_cache({})
+
+    assert body != scanner.CACHED_CLEAN, "a crawled page must never be cache-skipped"
+    assert "app.js" in body, "the body is needed to discover linked assets"
+    assert requested[0][1] is True, "the conditional GET is still sent — bandwidth is still saved"
+    assert len(requested) == 2, "a 304 on a page triggers an immediate unconditional refetch"
+
+
+@pytest.mark.asyncio
+async def test_a_terminal_asset_is_still_cache_skipped():
+    """The optimisation must survive the fix: JS bundles are leaves in the graph,
+    nothing is discovered from skipping them, so they still skip."""
+    import asyncio
+
+    class _Client:
+        async def get(self, url, headers=None, **kw):
+            return FakeResponse(304)
+
+    scanner.load_asset_cache({"https://x.example/app.js": {"etag": '"v1"', "was_clean": True}})
+    try:
+        _, body = await scanner.fetch_url(
+            _Client(), "https://x.example/app.js", asyncio.Semaphore(1),
+        )
+        assert body == scanner.CACHED_CLEAN
+        assert scanner.cached_clean_count() == 1
+    finally:
+        scanner.load_asset_cache({})
+
+
+@pytest.mark.asyncio
+async def test_a_scan_does_not_inherit_the_previous_scans_cache_tally():
+    """`_asset_cache_hits` is module state. A deep-scan host never primes the
+    cache, so without an explicit reset it reported the *previous* scan's hit
+    count as its own coverage."""
+    scanner.load_asset_cache({})
+    scanner._asset_cache_hits.update({"https://old/a.js", "https://old/b.js"})
+
+    async def _noop_spider(*a, **kw):
+        return []
+
+    import unittest.mock as mock
+    with mock.patch.object(scanner, "spider_target", _noop_spider):
+        result = await scanner.run_scan(target_url="https://new.example", scan_id="s2")
+
+    assert result["assets_cached"] == 0, "stale tally leaked into a fresh scan"
+    assert result["assets_scanned"] == 0
+
+
+def test_deep_scan_starts_from_an_empty_asset_cache():
+    src = (Path(__file__).resolve().parent.parent / "orchestrator.py").read_text(encoding="utf-8")
+    assert "scanner.load_asset_cache({})" in src
+
+
+def test_report_leads_with_coverage_not_downloads():
+    scan = {
+        "target_url": "https://x", "scan_id": "s", "status": "clean",
+        "assets_fetched": 0, "assets_cached": 9, "assets_scanned": 9,
+        "raw_findings": 0, "confirmed_findings": [], "needs_review_findings": [],
+    }
+    html = report.generate_html_report(scan)
+    assert "<b>Assets analysed</b> 9" in html
+    assert "unchanged since the previous scan" in html
+    assert "0 asset(s) were analysed" not in html
+
+
+def test_report_falls_back_for_records_written_before_the_cache_counters():
+    """Scans already in SQLite have no assets_scanned key."""
+    scan = {
+        "target_url": "https://x", "scan_id": "s", "status": "clean",
+        "assets_fetched": 4, "raw_findings": 0,
+        "confirmed_findings": [], "needs_review_findings": [],
+    }
+    assert "<b>Assets analysed</b> 4" in report.generate_html_report(scan)
+
+
+def test_deep_scan_rolls_up_cache_coverage():
+    d = _deep_result()
+    d.scans[0].update({"assets_fetched": 7, "assets_cached": 3, "assets_scanned": 10})
+    d.scans[1].update({"assets_fetched": 5, "assets_cached": 0, "assets_scanned": 5})
+    dd = d.to_dict()
+    assert dd["assets_cached"] == 3
+    assert dd["assets_scanned"] == 15
+    assert dd["totals"]["assets_scanned"] == 15
+
+
+def test_env_example_documents_report_full_secrets():
+    env = Path(__file__).resolve().parent.parent.parent / ".env.example"
+    assert "REPORT_FULL_SECRETS" in env.read_text(encoding="utf-8")
+
+
+assert os.environ.setdefault("SECRETNODE_API_KEY", "test-key")
diff --git a/backend/version.py b/backend/version.py
new file mode 100644
index 0000000..bcd65dc
--- /dev/null
+++ b/backend/version.py
@@ -0,0 +1,35 @@
+#!/usr/bin/env python3
+"""
+Single source of truth for the SecretNode version string.
+
+Every surface that stamps a version — the API banner, client reports, the
+Discord alerter — reads it from here, which in turn reads pyproject.toml. The
+alternative (a literal per module) is how the Discord alerter ended up still
+announcing "v2.4.0" long after the tool shipped 2.7.9: nothing fails when a
+hardcoded string goes stale, it just quietly misreports which build produced a
+finding, and a client correlating an alert against a report sees two tools.
+"""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+# Used only when pyproject.toml is unreadable (an odd install layout, a
+# stripped container). Keep it in step with pyproject on every release.
+_FALLBACK_VERSION = "2.8.0"
+
+
+def read_version() -> str:
+    """Parse `version = "x.y.z"` out of the project's pyproject.toml."""
+    try:
+        pyproject = Path(__file__).resolve().parent.parent / "pyproject.toml"
+        for line in pyproject.read_text(encoding="utf-8").splitlines():
+            s = line.strip()
+            if s.startswith("version") and "=" in s:
+                return s.split("=", 1)[1].strip().strip('"').strip("'")
+    except Exception:
+        pass
+    return _FALLBACK_VERSION
+
+
+TOOL_VERSION = read_version()
diff --git a/frontend/index.html b/frontend/index.html
index 3d6b449..a2bd1fe 100644
--- a/frontend/index.html
+++ b/frontend/index.html
@@ -384,6 +384,7 @@
     .badge-critical { background: rgba(255,59,59,0.15);  color: #ff3b3b;  border: 1px solid rgba(255,59,59,0.3); }
     .badge-high     { background: rgba(255,123,0,0.15); color: #ff7b00;  border: 1px solid rgba(255,123,0,0.3); }
     .badge-medium   { background: rgba(255,215,0,0.12); color: #ffd700;  border: 1px solid rgba(255,215,0,0.3); }
+    .badge-low      { background: rgba(49,130,206,0.12);color: #63b3ed;  border: 1px solid rgba(49,130,206,0.3);}
     .badge-info     { background: rgba(99,179,237,0.12);color: #63b3ed;  border: 1px solid rgba(99,179,237,0.3);}
 
     /* ── Stats cards ── */
@@ -816,12 +817,29 @@
     }
     const ts = () => new Date().toISOString().replace('T',' ').slice(0,19);
 
-    function severityFromType(type) {
-      const crit = ['AWS Access Key','AWS Secret Access Key','GitHub Personal Access Token','Stripe Secret Key','Private Key Block'];
-      const high = ['Google Cloud API Key','Slack Webhook','GitHub OAuth Token','SendGrid API Key','Twilio Auth Token','Heroku API Key','Shopify Access Token','Mailgun API Key','JWT Token'];
-      if (crit.includes(type)) return 'critical';
-      if (high.includes(type)) return 'high';
-      return 'medium';
+    // Severity comes from the backend, which reads it off the pattern registry
+    // and applies the public-by-design downgrade. This used to be re-derived
+    // here from a hardcoded list of 14 secret types; every detector added since
+    // — the whole AI/ML provider family included — fell through to MEDIUM, so
+    // the dashboard showed MEDIUM for a finding the SARIF and CSV both called
+    // HIGH. Never re-derive a value the server already computed.
+    const VALID_SEVERITIES = ['critical', 'high', 'medium', 'low', 'info'];
+
+    function severityOf(finding) {
+      const sev = String(finding?.severity || '').toLowerCase();
+      return VALID_SEVERITIES.includes(sev) ? sev : 'medium';
+    }
+
+    // Defence in depth: the API masks `raw_match` before it leaves the server,
+    // but the dashboard must never render a value that arrived unmasked (an
+    // older scan replayed from SQLite, a stale service behind a new frontend).
+    // If it carries no mask marker, mask it here before it hits the DOM.
+    function maskSecret(value) {
+      const v = String(value || '');
+      if (!v) return '';
+      if (v.includes('*') || v.includes('…')) return v;   // already masked
+      if (v.length <= 12) return '*'.repeat(v.length);
+      return `${v.slice(0, 6)}…${'*'.repeat(6)}…${v.slice(-4)}  (${v.length} chars)`;
     }
 
     function confidenceColor(c) {
@@ -954,7 +972,7 @@
       const tbody = $('findings-tbody');
       $('empty-row')?.remove();
 
-      const sev = severityFromType(finding.secret_type);
+      const sev = severityOf(finding);
       const cc  = confidenceColor(finding.confidence);
       const time = finding.found_at
         ? new Date(finding.found_at).toLocaleTimeString()
@@ -1026,7 +1044,7 @@
       const f = state.allFindings[index];
       if (!f) return;
 
-      const sev = severityFromType(f.secret_type);
+      const sev = severityOf(f);
       const mc  = $('modal-content');
       mc.innerHTML = `
         <div style="display:grid;grid-template-columns:1fr 1fr;gap:12px;margin-bottom:16px;">
@@ -1064,8 +1082,9 @@
           <pre style="font-family:'Share Tech Mono';font-size:10px;color:#68d391;background:rgba(0,0,0,0.4);padding:10px;border-radius:3px;border-left:2px solid #276749;overflow-x:auto;white-space:pre-wrap;word-break:break-all;">${escapeHtml(f.context_snippet||'')}</pre>
         </div>
         <div>
-          <div style="font-family:'Share Tech Mono';font-size:10px;color:#4a7c59;letter-spacing:0.1em;margin-bottom:5px;">MATCHED VALUE (PARTIAL)</div>
-          <code style="font-family:'Share Tech Mono';font-size:11px;color:#ff3b3b;background:rgba(255,59,59,0.08);padding:4px 8px;border-radius:2px;border:1px solid rgba(255,59,59,0.2);">${escapeHtml((f.raw_match||'').slice(0,60))}…</code>
+          <div style="font-family:'Share Tech Mono';font-size:10px;color:#4a7c59;letter-spacing:0.1em;margin-bottom:5px;">MATCHED VALUE (REDACTED)</div>
+          <code style="font-family:'Share Tech Mono';font-size:11px;color:#ff3b3b;background:rgba(255,59,59,0.08);padding:4px 8px;border-radius:2px;border:1px solid rgba(255,59,59,0.2);">${escapeHtml(maskSecret(f.raw_match))}</code>
+          <div style="font-family:'Share Tech Mono';font-size:9px;color:#4a7c59;margin-top:6px;">Enough to identify which key to rotate — the full value is never rendered here. Download a report to hand the value to the owner.</div>
         </div>
       `;
       $('modal-overlay').classList.add('show');
diff --git a/pyproject.toml b/pyproject.toml
index 349205d..f0016c1 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "secretnode"
-version = "2.7.9"
+version = "2.8.0"
 description = "Real-time passive attack-surface scanner for credential-leak detection, with a two-tier Gemini AI validation engine (google-genai), live verification, source-map mining, WAF-resilient fetching, SARIF export, and a live dashboard."
 readme = "README.md"
 requires-python = ">=3.11"