Repository navigation
Match equivalent findings across Standard and Deep scans #669
Description
Activity
Hi, I’d like to work on this issue. I’ll investigate how
identity.anchoris generated across Standard and Deep scans, identify why equivalent findings receive different anchors, and add a fix with regression tests. I’ll share my plan ASAP. Please confirm before I start investigating and implementing a fix.- added a commit that references this issue
on Sep 8, 2026 I've opened a PR to fix this issue #832
Standard and Deep scans of the same repository revision can assign different
identity.anchorvalues to the same vulnerability. Consequently,scans comparemay report the previous finding as unknown and the equivalent new finding as newly introduced.Reproduction: run both scan modes against the same synthetic vulnerable repository, then compare their results.
Expected: equivalent findings with matching vulnerability families and source locations remain identifiable across scan modes.