0.4.1

Core 0.4.1 is published for Rust, Python, Node.js, and browser WASM. All four runtimes passed clean registry-installed verification. See the GitHub release.

Release provenance

The release source is 175e67548f654c740352a7d909ae55d376dfcb0d. All four runtime packages are published at version 0.4.1.

Runtime	Registry package	Installation verification
Rust	`datafog-core` 0.4.1	Passed in a clean registry-only consumer
Python	`datafog-core` 0.4.1	Passed with a clean registry wheel and actual Python 4.9 adapter
Node.js	`@datafog/node` 0.4.1	Passed with a clean npm installation and native Node 24
Browser WASM	`@datafog/wasm` 0.4.1	Passed in actual Chromium with a clean npm installation

The Rust registry consumer verified capability contract 1, the 23/14 inventory, all three credential detectors, Unicode byte/code-point ranges, explicit-label redaction, and unsupported-locale rejection. Its Cargo.lock resolved crates.io with checksum 25b0893bd983973d65793f6406f18e0b1da30f1996148996813758b16ea20b29. The Python workflow published five platform wheels and a source distribution. The clean PyPI macOS ARM64 wheel passed installed binding and typing checks, pip check, all 352 adapter regression tests against adapter source e31e9e5dd97581622515a97e4421dc558828e706, and the portable 10-fixture, 60-transformation overlap audit. Frozen parity remained unchanged. The browser WASM npm installation passed all ten conformance helpers in Chromium, including 23/14 inventory parity and detectorVersion: 0.4.1.

Published Python artifact	SHA256
macOS ARM64 wheel	`2f18f93854ae335b3e12de52b61c29b7013ff03e601bf67380cb09712ecef5cb`
Source distribution	`74a8f545ccfff8d52a149ac9bc02cd6cc8295e883cd36cbb96b6b5f460f35807`

The Node.js registry installation passed all ten conformance helpers using the native binding on Node 24. Checks covered 23/14 scan inventory parity, structured PERSON, German and UUID opt-ins, and detectorVersion: 0.4.1. The npm lockfile confirmed registry provenance without a local package archive. Publishing workflows: Rust, Python, Node.js, and browser WASM.

New default detectors

Core 0.4.1 adds three labels to ordinary text and structured scanning, without changing capability contract version 1. The runtime registry now reports 23 supported entities and 14 default text detectors; the capabilities reference is generated from that registry. All bindings use the Rust implementations and preserve existing finding offsets and provenance. Locale and UUID activation rules are unchanged.

Label	Recognition scope	Finding span
`API_KEY`	Provider-prefixed GitHub tokens and Stripe secret/restricted keys	Complete key, excluding surrounding assignment/header context
`BEARER_TOKEN`	Explicit Authorization headers and quoted JSON header entries; structured immediate `Authorization` string fields	Token only, excluding `Bearer` and header context
`CREDENTIAL_URI`	Scoped `postgres://` or `postgresql://` URI with explicit nonempty password in user information	Complete original URI, including path/query and original percent encoding

These are lexical detectors. They do not authenticate credentials, contact providers, check entropy, or establish that a connection succeeds.

Provider key heuristics

API key detection recognizes case-sensitive GitHub ghp_, gho_, and ghu_ bodies of exactly 36 ASCII letters/digits; ghr_ bodies of 76; and github_pat_ bodies of 22 letters/digits, an underscore, and 59 letters/digits. Installation tokens beginning ghs_ are opaque: at least 36 letters/digits, underscores, hyphens, or periods, with no JWT decoding or segment-count requirement. A final period remains part of an otherwise valid ghs_ value. Stripe sk_test_, sk_live_, rk_test_, and rk_live_ keys require at least 24 ASCII letters/digits after the prefix. That minimum is a detector heuristic, not a provider-issued-key guarantee. Publishable keys, webhook secrets, organization keys, unprefixed strings, and other provider formats are excluded. The reference defines exact boundaries and whole-value rejection rules.

Bearer context

Bearer detection requires explicit Authorization context. Raw headers must occupy a header line; quoted JSON header entries must satisfy the documented boundaries. Structured scanning also accepts a string leaf immediately named Authorization, ignoring ASCII case, and preserves Bearer when transforming the token. Arrays under that key, sibling fields, prefixed header names, and bare Bearer TOKEN prose do not supply context. Tokens follow the RFC 6750 alphabet and terminal-padding rule.

Credential URI boundaries

Credential URI detection accepts the two PostgreSQL scheme spellings with ASCII case-insensitive matching, an explicit nonempty password, and a single supported hostname, IPv4/IPv6 host, or omitted host. Decimal ports and percent triplets are recognized lexically; port ranges and decoded credential content are not validated. Whole-URI spans preserve RFC-valid terminal punctuation, which can be ambiguous with prose. Passwordless or query-only secrets, multiple hosts, percent-encoded Unix socket hosts, fragments, raw Unicode URI content, JDBC prefixes, and other schemes remain outside this initial scope. See the detector reference for encoding and delimiter rules.

Legacy Python overlap compatibility

The Python 4.9 adapter was integrated in merged PR #179. The local candidate-wheel audit below exercises that adapter source. This Core release does not change Python’s default backend or publish the higher-level package. Its existing legacy path resolves overlaps before filtering selected labels. That order is preserved rather than introducing special priorities for the new labels. Consequently, explicit legacy entity selection can return no finding even when Core originally detected the selected label:

Overlapping findings	Legacy overlap result before selection
`API_KEY` and `BEARER_TOKEN` on the same span	`API_KEY` suppresses `BEARER_TOKEN`
`BEARER_TOKEN` and `JWT` on the same span	`BEARER_TOKEN` suppresses `JWT`
A containing `CREDENTIAL_URI` and an inner `API_KEY` or `JWT`	`CREDENTIAL_URI` suppresses the inner finding

Native Core and datafog.v5 scan results retain the overlapping candidates; native transformations apply entity selection before resolving overlaps. Callers requiring a particular label can use that native interface. The previously reviewed PHONE/NPI limitation is described in the 0.4.0 release notes.

Local exact-wheel integration result

PASS: the exact candidate wheel was installed with the actual Python 4.9 adapter in an isolated environment. Installed artifact provenance matched the expected SHA256. No functional integration failures were found.

Evidence	Validated value
Core wheel	`datafog_core-0.4.1-cp310-abi3-macosx_11_0_arm64.whl`
Wheel SHA256	`d6ad451b8ebdd303a9a22410805f83b55876cd22062ce2f9ecb470b4bcd4ec3f`
Python adapter source	`e31e9e5dd97581622515a97e4421dc558828e706`, installed as editable `datafog==4.9.0`
Local platform	CPython 3.12.13, macOS 26.6.2 ARM64
Adapter and frozen regression suites	352 passed; no skips or expected failures
Credential overlap audit	10 fixtures, 60 native/v5 transformations, and individual legacy label selections passed
Installed Core binding suite	Text, structured, capability, provider, transformation, and detector fixtures passed
Dependency consistency	`pip check` passed

Reviewed frozen parity remained 77 matches, 2 detector differences, 1 validation difference, and 31 cases outside backend scope, with no additional deviations. The overlap audit confirmed the legacy selection differences above, exact/regex allowlists, Unicode offsets, structured Authorization context and exclusions, and locale acceptance/rejection. Python’s default backend remained Python; the new credential labels did not silently activate there.

Reproduce the local gate

Set ADAPTER_CHECKOUT to the reviewed Python adapter checkout, CORE_CHECKOUT to the matching Core conformance checkout, CORE_WHEEL to the exact wheel, PYTHON to CPython 3.12, and VENV to a fresh environment directory. The checked-in bindings/python/tests/test_python49_integration.py exercises the real installed adapter and expands the shared synthetic fixtures. It prints a summary by default; --output optionally saves detailed JSON evidence. These commands install the local wheel rather than resolving Core from a registry:

"$PYTHON" -m venv "$VENV"
"$VENV/bin/python" -m pip install -e "${ADAPTER_CHECKOUT}[test,cli]" "$CORE_WHEEL"
"$VENV/bin/python" -m pip check
(
  cd "$ADAPTER_CHECKOUT"
  "$VENV/bin/python" -m pytest \
    tests/test_contract_481.py tests/test_core_capability_adapter.py \
    tests/test_rust_backend.py tests/test_api_bridge_49.py \
    tests/test_core04_integration.py tests/test_rust_contract.py -q
  "$VENV/bin/python" -m tests.rust_contract --output "$VENV/parity.json"
)
"$VENV/bin/python" "$CORE_CHECKOUT/bindings/python/tests/test_installed.py"
"$VENV/bin/python" "$CORE_CHECKOUT/bindings/python/tests/test_python49_integration.py" \
  --output "$VENV/overlap-results.json"

Verify the wheel SHA256 before installation and retain pip’s direct_url.json artifact provenance with the results. The wheel hash above identifies the binary actually exercised by this local gate; it is separate from registry artifact checksums. The final release source is recorded above. See the validation limits before treating this result as release readiness.

Validation limits

This result covers one local macOS ARM64 wheel on CPython 3.12.13. It does not establish cross-platform wheel compatibility, complete the Rust/Node/browser WASM gates, authorize publication, or verify registry-installed artifacts. Post-publication installation results are recorded separately above. This local evidence must not be substituted for those registry checks.

Get started

Core concepts

Guides

SDK reference

Releases

Research

Contributing

Release provenance

New default detectors

Provider key heuristics

Bearer context

Credential URI boundaries

Legacy Python overlap compatibility

Local exact-wheel integration result

Reproduce the local gate

Validation limits

​Release provenance

​New default detectors

​Provider key heuristics

​Bearer context

​Credential URI boundaries

​Legacy Python overlap compatibility

​Local exact-wheel integration result

​Reproduce the local gate

​Validation limits

Release provenance

New default detectors

Provider key heuristics

Bearer context

Credential URI boundaries

Legacy Python overlap compatibility

Local exact-wheel integration result

Reproduce the local gate

Validation limits