@@ -26,6 +26,7 @@
 from ...utils.redaction import (
 	is_credential_finding,
 	redact_dataflow_trace,
+	redact_message,
 	redact_snippet,
 )
 
@@ -412,6 +413,14 @@ def _convert_to_socket_facts(self, raw_results: Any) -> Dict[str, Any]:
 						severity = ((r.get('extra') or {}).get('severity') or r.get('severity') or '')
 						severity_norm = str(severity).lower() if severity is not None else ''
 						message = (r.get('extra') or {}).get('message') or r.get('message') or ''
+						credential_finding = is_credential_finding(
+							check_id, (r.get('extra') or {}).get('metadata') or {}
+						)
+						message = redact_message(
+							message,
+							(r.get('extra') or {}).get('metavars') or {},
+							credential_finding=credential_finding,
+						)
 						start = (r.get('start') or {}).get('line')
 						end = (r.get('end') or {}).get('line')
 
@@ -435,9 +444,7 @@ def _convert_to_socket_facts(self, raw_results: Any) -> Dict[str, Any]:
 						code_snippet = (r.get('extra') or {}).get('lines') or (r.get('extra') or {}).get('snippet') or ''
 						code_snippet = redact_snippet(
 							code_snippet,
-							credential_finding=is_credential_finding(
-								check_id, (r.get('extra') or {}).get('metadata') or {}
-							),
+							credential_finding=credential_finding,
 						)
 
 						alert = {
 
@@ -184,7 +184,9 @@ def _output_file_patterns(self) -> List[str]:
         if not output_dir:
             return []
         try:
-            output_path = Path(output_dir) / output_name
+            output_path = Path(
+                self._absolute_scan_target(Path(output_dir) / output_name)
+            )
         except (TypeError, ValueError):
             return []
 
 
@@ -20,8 +20,9 @@
     of every string literal on the line, keeping the assignment target and the
     surrounding syntax so the finding is still readable.
 
-``redact_snippet`` composes them, and ``is_credential_finding`` decides which
-rules get the second pass.
+``redact_snippet`` composes them, ``redact_message`` removes values interpolated
+into rule messages, and ``is_credential_finding`` decides which rules get the
+second pass.
 """
 
 import re
@@ -32,6 +33,7 @@
     "scrub_tokens",
     "redact_literals",
     "redact_snippet",
+    "redact_message",
     "redact_dataflow_trace",
     "is_credential_finding",
 ]
@@ -132,7 +134,11 @@ def _mask_match(match: 're.Match[str]') -> str:
     secret = match.group(1)
     if not secret:
         return whole
-    return whole.replace(secret, mask_value(secret), 1)
+    secret_start, secret_end = match.span(1)
+    match_start = match.start(0)
+    relative_start = secret_start - match_start
+    relative_end = secret_end - match_start
+    return f"{whole[:relative_start]}{mask_value(secret)}{whole[relative_end:]}"
 
 
 def scrub_tokens(text: Any) -> str:
@@ -158,35 +164,33 @@ def redact_literals(text: Any) -> str:
     if not isinstance(text, str) or not text:
         return text if isinstance(text, str) else ''
 
-    found_literal = False
-
     def _mask_literal(match: 're.Match[str]') -> str:
-        # A quoted empty string is recorded as a literal even though there is
-        # nothing to mask, so an already-quoted line does not fall through to
-        # the unquoted branch and get its quotes masked instead.
-        nonlocal found_literal
-        found_literal = True
         body = match.group('body')
         if not body:
             return match.group(0)
         quote = match.group('quote')
         return f'{quote}{mask_value(body)}{quote}'
 
-    redacted = _STRING_LITERAL.sub(_mask_literal, text)
-    if found_literal:
-        return redacted
-
-    # No literal on the line, so fall back to masking each assignment's value.
+    # Mask unquoted assignments line by line before processing literals. A
+    # quoted value is left for the literal pass, while an unquoted value is
+    # masked even if another line or a trailing comment contains quoted text.
     masked_lines = []
     for line in text.split('\n'):
         match = _UNQUOTED_ASSIGNMENT.match(line)
-        if match:
+        body = match.group('body') if match else ''
+        if match and not body.lstrip().startswith(('"', "'", '`')):
+            # If quoted text appears later in an unquoted value, mask the whole
+            # body. Measuring that combined text could otherwise make a short
+            # credential eligible for a partial reveal.
+            masked_body = (
+                '*' * len(body) if _STRING_LITERAL.search(body) else mask_value(body)
+            )
             masked_lines.append(
-                f"{match.group('head')}{mask_value(match.group('body'))}{match.group('tail')}"
+                f"{match.group('head')}{masked_body}{match.group('tail')}"
             )
         else:
             masked_lines.append(line)
-    return '\n'.join(masked_lines)
+    return _STRING_LITERAL.sub(_mask_literal, '\n'.join(masked_lines))
 
 
 def is_credential_finding(rule_id: Any, metadata: Mapping[str, Any] | None = None) -> bool:
@@ -217,6 +221,32 @@ def redact_snippet(text: Any, credential_finding: bool = False) -> str:
     return scrubbed
 
 
+def redact_message(text: Any, metavars: Any = None,
+                   credential_finding: bool = False) -> str:
+    """Mask credentials interpolated into a scanner rule's message.
+
+    OpenGrep expands metavariables before returning a result. For credential
+    findings, mask every expanded metavariable that appears in the message;
+    the connector cannot reliably identify which metavariable held the secret.
+    Well-known token formats are scrubbed from every message independently.
+    """
+    redacted = scrub_tokens(text)
+    if not credential_finding or not isinstance(metavars, Mapping):
+        return redacted
+
+    values = set()
+    for details in metavars.values():
+        if not isinstance(details, Mapping):
+            continue
+        value = details.get('abstract_content')
+        if isinstance(value, str) and value:
+            values.add(value)
+
+    for value in sorted(values, key=len, reverse=True):
+        redacted = redacted.replace(value, mask_value(value))
+    return redacted
+
+
 def redact_dataflow_trace(trace: Any) -> Any:
     """Scrub the code fragments carried by a taint-mode dataflow trace."""
     if not isinstance(trace, dict):
 
@@ -24,6 +24,7 @@
     mask_value,
     redact_dataflow_trace,
     redact_literals,
+    redact_message,
     redact_snippet,
     scrub_tokens,
 )
@@ -123,6 +124,11 @@ def test_credentials_in_a_url_authority_are_masked(self):
         # The host stays readable so the finding still points somewhere.
         assert "db.internal:5432/app" in scrubbed
 
+    def test_url_password_is_masked_when_it_matches_the_username(self):
+        scrubbed = scrub_tokens("postgres://admin:admin@db.internal/app")
+        assert scrubbed.startswith("postgres://admin:")
+        assert ":admin@" not in scrubbed
+
     def test_ordinary_code_is_left_alone(self):
         for snippet in (
             "eval(rawConfigStr)",
@@ -159,6 +165,18 @@ def test_unquoted_assignments_fall_back_to_masking_the_value(self):
         assert "SuperSecret123!" not in redacted
         assert redacted.startswith("password: ")
 
+    def test_quoted_text_does_not_skip_an_unquoted_value(self):
+        redacted = redact_literals('password: hunter2 # "temporary"')
+        assert "hunter2" not in redacted
+        assert redacted.startswith("password: ")
+
+    def test_each_line_uses_the_appropriate_redaction(self):
+        redacted = redact_literals(
+            'credentials:\n  user: "admin"\n  password: hunter2'
+        )
+        assert "admin" not in redacted
+        assert "hunter2" not in redacted
+
     def test_empty_literals_are_left_as_they_are(self):
         assert redact_literals('password = ""') == 'password = ""'
 
@@ -240,6 +258,25 @@ def test_a_non_credential_finding_still_loses_a_recognizable_token(self):
         assert "console.log" in redacted
 
 
+class TestRedactMessage:
+    def test_interpolated_metavariables_are_masked_for_credential_findings(self):
+        secret = "SuperSecret123!"
+        redacted = redact_message(
+            f"Hardcoded credential {secret} assigned to database_password",
+            {
+                "$VALUE": {"abstract_content": secret},
+                "$VAR": {"abstract_content": "database_password"},
+            },
+            credential_finding=True,
+        )
+        assert secret not in redacted
+        assert "database_password" not in redacted
+        assert redacted.startswith("Hardcoded credential ")
+
+    def test_known_tokens_are_scrubbed_from_every_message(self):
+        assert AWS_KEY_ID not in redact_message(f"Logged value: {AWS_KEY_ID}")
+
+
 class TestRedactDataflowTrace:
     def test_trace_steps_are_scrubbed(self):
         trace = {
@@ -275,8 +312,11 @@ def test_opengrep_alerts_carry_no_credential(self, tmp_path):
                     "end": {"line": 3},
                     "extra": {
                         "severity": "ERROR",
-                        "message": "Hardcoded secret or credential detected",
-                        "lines": 'STRIPE_SECRET_KEY = STRIPE_KEY',
+                        "message": f"Hardcoded credential detected: {STRIPE_KEY}",
+                        "lines": f'STRIPE_SECRET_KEY = "{STRIPE_KEY}"',
+                        "metavars": {
+                            "$VALUE": {"abstract_content": STRIPE_KEY},
+                        },
                         "metadata": {"cwe": "CWE-798", "confidence": "medium"},
                     },
                 }
 
@@ -212,6 +212,17 @@ def fake_run(command, **kwargs):
     assert command[-1] == str(tmp_path)
 
 
+def test_output_file_patterns_are_absolute_for_relative_output_dir(tmp_path, monkeypatch):
+    monkeypatch.chdir(tmp_path)
+    scanner = _scanner(Path("."), "")
+    scanner.config.output_dir = Path(".")
+
+    patterns = scanner._output_file_patterns()
+
+    assert scanner._path_matches_patterns(str(tmp_path / ".socket.facts.json"), patterns)
+    assert scanner._path_matches_patterns(str(tmp_path / ".socket.facts.json.tmp"), patterns)
+
+
 def test_process_results_strips_absolute_workspace_from_output_and_id(tmp_path):
     scanner = _scanner(tmp_path, "")
     scanner.generate_notifications = lambda components: {}