[Feature] Security Regression Detection and Historical Scan Comparison

[KolaSailaja]

Summary

Add a Security Regression Detection system that compares current scan results against previous scans and highlights increases or decreases in security risk over time.

Motivation

Currently PatchPilot provides a snapshot of security findings for a single scan, but it does not help users understand how the security posture of a project evolves over time.

Security teams often need to answer questions such as:

• Did this release introduce new vulnerabilities?
• Has the number of Critical findings increased?
• Are remediation efforts improving security posture?
• Which scanner categories are regressing over time?

Users currently have to manually compare scan reports and evidence packs, which is inefficient and error-prone.

Introducing Security Regression Detection would enable continuous security monitoring and make PatchPilot more suitable for production CI/CD workflows.

Proposed solution

Store scan summaries and findings history for each project/job and compare new scan results against a selected baseline scan.

Backend

• Persist scan history and metadata.

• Add a regression analysis service.

• Compare:

  • Critical findings
  • High findings
  • Medium findings
  • Low findings
  • Secrets detected
  • Dependency vulnerabilities
  • SAST findings

Example Output

{
  "baseline_scan": "scan_001",
  "current_scan": "scan_002",
  "regressions": {
    "critical": 2,
    "high": 4
  },
  "improvements": {
    "medium": 6
  },
  "overall_trend": "Worsened"
}

Frontend

Add a Security Trends page showing:

• Finding count changes
• Severity distribution over time
• Security posture improvements
• Newly introduced vulnerabilities
• Fixed vulnerabilities

Evidence Pack Integration

Include:

security-regression-report.json
security-trend-summary.txt

in generated evidence packs.

ML tier (if applicable)

• Tier 1 — Triage (severity ranking, deduplication, false positive classification)
• Tier 2 — Predictive (fix success prediction, exploit scoring, pattern clustering)
• Tier 3 — Autonomous (LLM patch generation, self-healing pipeline)
• Not ML-related

Alternatives considered

1. Manual report comparison

   • Rejected because it does not scale and increases analyst effort.

2. External dashboard integrations

   • Rejected because users should be able to track security posture directly within PatchPilot.

3. Comparing only severity counts

   • Rejected because users also need insight into newly introduced and resolved findings.

Acceptance criteria

• PatchPilot stores scan history for comparison.
• Users can compare a scan against a baseline scan.
• Regression reports identify new, fixed, and persistent findings.
• Security trend information is displayed in the frontend and exportable through Evidence Packs.

Additional context

This feature aligns with enterprise vulnerability management workflows where security posture is tracked continuously rather than through isolated scans. It would provide valuable insights for CI/CD pipelines, security audits, and compliance reporting.

[KolaSailaja]

Hi @ionfwsrijan ,

I would like to work on this feature under SSOC26. Security Regression Detection would help users track how their security posture changes over time and identify newly introduced vulnerabilities between scans.

Could you please assign this issue to me under SSOC26? I’d be happy to work on the implementation and submit a PR.

Thank you!