Understand new, persisting and absent findings without treating absence as proof of a fix.
Choose scans and read comparability first
From a scan, compare with the previous recorded decision or choose another scan of the same target. From Decision History, select two recorded decisions. Cross-target comparisons are refused. The response orders the earlier scan as the base and the later as the head.
Comparability names the factors that limit conclusions: policy or fail-on changes, engine changes, mode and scope differences, missing or newly delivered analyzers, truncated endpoints, suppressions, imports and missing identity. A run that did not complete gives insufficient evidence; no shared delivered analyzer makes the pair not comparable. Other limiting factors make it partially comparable.
How findings are matched
Stable engine identities match findings and their occurrences within a compatible fingerprint scheme. A unique bridge can match older and newer engine identities. Backend fallback fingerprints are weaker evidence, not stable engine identity.
Without stable identity, exact semantic evidence within the same file or manifest may establish moved or changed: rule, operation and function; advisory and package; or rule and credential identifier. Weaker or cross-file evidence produces possible match only. Ambiguous candidates are not promoted. Severity, CWE, a title alone or a line number alone never establishes identity.
New and persisting describe the comparison, not when a vulnerability was introduced. New occurrences highlight additional locations of a matched finding. Possible matches remain a separate class rather than counting as one new plus one absent finding.
Comparable and incomplete examples
Example A: both scans completed with complete required coverage, reliable identities, unchanged scope and no suppressions. One dependency finding disappears and another persists. The first is no longer detected under those conditions; this still does not prove which code change removed it or that the system is secure.
Example B: the later scan’s required Semgrep run failed. Even a missing dependency finding is inconclusive because overall required coverage is incomplete. Do not cherry-pick an earlier successful scan to call the latest absence verified. The demo offers separate comparison pairs for these cases.
A threshold change from HIGH to CRITICAL can make a decision less restrictive without reducing risk. Inspect the explanation factors and original findings before interpreting the verdict change.