Regression Diff

After every scan, CodeScan automatically compares results against your previous scan and shows which vulnerabilities are new, which were fixed, and which remain unchanged. This turns raw findings into an actionable signal: is the codebase improving or regressing?

Where to find it

After a scan completes, the CODE FINDINGS tab shows two new badges next to the count:

Individual file cards also show a +N new badge when that file introduced new findings since the last scan.

How fingerprinting works

Each finding is fingerprinted by its category + title + file path. Two findings match across scans if all three are identical. This means:

• A finding that moves to a different line in the same file is still considered the same finding (not new).
• A finding with the same title in a different file is considered separate.
• Renaming a file resets its diff — the old file's findings appear fixed and the new file's findings appear new.

Requirements

Regression diff requires at least two scans saved to history. Scans are auto-saved after every web scan. For CLI, use --save-history. The first scan shows no diff — the diff appears from the second scan onwards.