v4.1
Rescans and fix verification, file-based ServiceNow status exchange, repository-scoped finding identity and reused architecture analysis.
v4.0 made ScanSuite good at finding things. This release makes it good at the part that comes after: proving a fix landed, keeping one finding one finding across rescans and repositories, and moving statuses between ScanSuite and ServiceNow without opening a connection to it.
The organising idea, as in v4.0: nothing is asserted that cannot be shown. A finding is not closed because a scan went quiet — it is closed because an agent read the current source and pointed at the code that fixed it.
Rescans and fix verification
| Capability | Description |
|---|---|
| Verify Fixes | A scanning mode expressed in findings rather than files. Select the findings you believe are fixed; ScanSuite resolves them to their files, scans only those, and reassesses exactly what you selected — a finding sharing a file with a selected one is never touched. |
| Fix verification agent | Reads the current source for a finding that a scan covered but did not report, and returns one of five verdicts. Only fixed and file_removed close anything, and a fixed verdict is refused without file:line evidence or at low confidence. |
| Reconciliation | Every rescan partitions the repository’s findings into confirmed, covered-but-not-reported, held by an analyst decision, and outside coverage, and reports the counts in the scan log. |
| Scan coverage | Per-file analysis outcomes are recorded, so a scan draws conclusions only about files it actually analysed. A skipped or failed file is not coverage. |
| Automatic regression reopening | A resolved finding that a later scan detects again reopens on its own, and its stale closure evidence is cleared. |
| Analyst decisions are protected | Risk Accepted and False Positive can never be moved by a scan, in either direction. |
Closure is off until you switch it on, under Settings → Resolve findings verified as fixed. With it off the whole pipeline still runs and still logs, so you can read the verdicts your codebase produces before letting them change any ticket.
See Rescans and fix verification.
ServiceNow, by file
The direct ServiceNow integration and its settings have been removed. In their place, findings leave as a ServiceNow XLSX export and the statuses ServiceNow assigns come back as a file. No credentials are stored, no port is opened, and nothing leaves the perimeter unless a person sends it.
| Change | Description |
|---|---|
| Export menu | The separate export buttons on the Vulnerabilities page are now one menu: XLSX, JSON, and ServiceNow XLSX. |
| Stable tracking ids | Every finding carries an id that survives rescans and releases, so the spreadsheet, the scan log, the JSON report and the console all name the same finding by the same string. |
| Status drift | Where the statuses returned from ServiceNow disagree with what ScanSuite believes, the difference is surfaced rather than silently overwritten. |
Finding identity
Static finding identity is now scoped to the repository as well as the product. Previously two repositories in the same product that shared a file path — an index.js, a settings.py — could collapse into a single record, and whichever scanned second overwrote the first.
Identity also no longer compares the vulnerable parameter or the quoted code. Models word those differently on every run, which produced duplicate records for one defect. Two findings are the same when their normalised vulnerability class and source file match, within one product and one repository.
Existing findings were re-keyed in place. Tracking ids already sent to a ticketing system did not change, so nothing that was exported before this release needs re-exporting.
Faster scans
| Capability | Description |
|---|---|
| Security architecture reuse | The repository-level architecture analysis is generated once and stored, then reused by every scanning mode except a full scan — which refreshes it. On a small scoped rescan this was most of the runtime. |
| Reuse when the analysis is switched off | Disabling the architecture pass now means "do not build one", not "pretend we know nothing" — a stored report is still used for scoring. |
| Provenance on every reuse | The scan log names the scan, branch and commit a reused report came from, so a surprising score can be traced to the picture it was scored against. |
| Manual refresh | An administrator can discard a repository’s stored analysis so the next scan rebuilds it, without waiting for a full scan. |
Clearer output
| Change | Description |
|---|---|
| Named decisions | Deduplication and recurrence now say which findings were merged and into what, and on which values — not just how many. Large scans name the first twenty of each kind and count the rest. |
| Verification progress | Each verdict is logged as it lands, with the finding’s id, the decision, the confidence and the evidence behind it. |
| Top 10 Vulnerability Classes | The Vulnerabilities dashboard now ranks vulnerability classes instead of finding titles, with a severity breakdown and the number of repositories each class spans. Model-authored titles vary between runs, so the old panel spent its ten slots on wording rather than on risk. Clicking a class filters the list to exactly the findings it counted. |
Fixes
| Fix | Description |
|---|---|
| Verify Fixes scanned the whole repository | A mode-name mismatch between the console and the scan runtime meant a Verify Fixes submission fell through to a full repository scan. It routes correctly and scans only the selected findings’ files. |
| Selections were dropped in the runtime | The scan’s scope record was rebuilt without the selected finding ids, so a run could reassess — and with closure enabled, resolve — findings nobody had selected. The selection is now carried through, and a run that arrives without one refuses to close anything. |
| Verification could fail silently | Writing a scan log line closes the database session, which detached the findings being verified and aborted the whole pass. Verification now re-reads each finding as it works. |
| AI provider connectivity behind a proxy | Both the Anthropic and OpenAI SDKs are reached through an adaptive HTTP transport, and a custom CA bundle is now added to the system trust store rather than replacing it — a proxy certificate no longer breaks verification of everything else. |
| Concurrent startup | Services starting together no longer race when a release adds a table. |
Upgrading from v4.0? Two things are worth doing deliberately. Run one full scan per repository so each has a stored security architecture analysis to reuse, and leave Resolve findings verified as fixed off until you have read a few rescans' verdicts. Everything else applies itself.
Last reviewed 2026-08-27