sc-diff-report

To run an incremental security scan on changed files, execute a diff-based scan targeting the git diff between branches or commits. This identifies added, modified, renamed, and deleted files, filtering out non-security-relevant changes to generate a focused Security Diff Report.

Yes, you can scan staged changes or the most recent commit for vulnerabilities. The scan supports PR mode, staged changes, and last-commit scans, classifying findings as new or existing to prioritize remediation for the touched files.

Incremental vulnerability scanning targets only the files present in a git diff, pull request, or recent commit. By focusing solely on touched files and filtering out unchanged code, it significantly reduces noise and provides fast, targeted security feedback during code review.

Yes, the diff scan classifies targeted vulnerability findings as either new, meaning introduced by the recent changes, or existing, meaning they were already present in the touched files. This classification helps prioritize remediation efforts effectively.

You generate a security diff report for a pull request by running the scan in PR mode. It analyzes the changed files, performs targeted vulnerability scanning, and outputs a detailed Security Diff Report at a configurable path summarizing findings and hunks.

The best way to get fast security feedback during code review is using incremental security scans. By scanning only the files in the diff between branches or commits and filtering non-security-relevant changes, it delivers quick verification tailored specifically to touched files.