Comparing audits
See what a repository fixed, what is new and what is still open since the previous audit.
A risk score that moved from 71 to 64 does not tell you why. The repository page compares the newest audit with the one before it and sorts every finding into three groups.
- Fixed — present in the previous audit, gone from the newest one.
- New — in the newest audit only.
- Still open — in both, deep-linked into the current report so you can pick it up.
How findings are matched
Two findings are treated as the same issue when they share a weakness — the CWE, or the title when the model gave no CWE — and the same file. Line numbers are deliberately ignored, because code moves and the issue does not. That is why a fix still counts as fixed after a refactor that shifted everything down forty lines.
Reading it honestly
A finding can also leave a report because the file it lived in was not read this time, for instance after the repository grew past your plan's file budget. The report header says when the source was truncated; take that into account before celebrating a long "fixed" column.