Compare, trust & readiness
Three companion views answer: what changed, how reliable is this scan, and can I rerun?
Compare
Compare answers what changed against the prior successful scan on the same target. It surfaces baseline, new, regressed, fixed, recurring, and suppressed counts plus highlighted movement so you can read churn at a glance.
GET /api/scan-runs/{id}/compareTrust
Trust explains how reliable the run is. It carries:
- Score and label.
- Verification mix — verified vs unverified findings.
- Skipped scanners and the reason each was skipped.
- Replay readiness for runtime-discovered issues.
- Coverage gaps (missing credentials, sandbox limits, build failures).
- Recommended follow-up actions.
GET /api/scan-runs/{id}/trustReadiness
Readiness answers can I rerun. The endpoint checks GitHub access, missing env-var signals, scanner gaps, replay prerequisites, and whether rerun is available. The dashboard surfaces rerun affordance only when readiness is positive.
GET /api/reviews/{id}/readiness
POST /api/reviews/{id}/rerunDegraded scans
A scan completes degraded when it ran with limited coverage. Findings still persist, but trust drops and the run should be reviewed for skipped scanners, coverage gaps, missing secrets, or sandbox limitations. Use the repo secrets page to fix missing credentials before rerunning.