How scan comparison works
Scan comparison produces a structured diff between any two completed scans of the same target. It identifies findings that appeared, disappeared, or stayed the same, and calculates performance deltas. Use it after deployments, patches, or on a weekly cadence to confirm your security posture is improving.
Comparing scans in the UI
- Open the Scan History tab.
- Check the checkbox next to two completed scans (order doesn't matter — Shieldome sorts by date automatically).
- Click the Compare button that appears in the action bar.
- The diff view opens showing four sections: New, Resolved, Unchanged, and Performance delta.
You can only compare scans of the same target URL. Comparing scans of different targets returns a 400 Bad Request error with a clear explanation.
Diff view sections
| Section | Description |
|---|---|
| New findings | Appeared in scan B but not in scan A — these are regressions or newly discovered issues |
| Resolved findings | Present in scan A but gone in scan B — fixed or no longer detectable |
| Unchanged findings | Present in both scans — open issues that persist across the comparison window |
| Performance delta | Side-by-side performance metrics with change indicators (faster/slower/unchanged) |
Comparison API
The same diff data is available via the API. Pass the baseline scan ID in the path and the comparison scan ID as the second path segment:
bash
curl -H "X-Shieldome-Key: YOUR_API_KEY" \ "https://yourdomain.com/api/scan/SCAN_ID_A/diff/SCAN_ID_B"
json — response structure
{
"scan_a": { "id": "...", "started_at": "2026-06-01T10:00:00", "target_url": "https://example.com" },
"scan_b": { "id": "...", "started_at": "2026-06-08T10:00:00", "target_url": "https://example.com" },
"rows": [ // one entry per unique finding across both scans
{
"key": { "owasp_id": "A05:2021", "name": "Missing Content-Security-Policy" },
"diff": "added", // added | removed | same | severity_changed | status_changed
"scan_a": null, // null when the finding did not exist in scan_a
"scan_b": { "severity": "high", "status": "vulnerable" /* ... full finding */ }
},
{
"key": { "owasp_id": "A07:2021", "name": "Insecure Cookie (missing Secure flag)" },
"diff": "removed", // present in scan_a, gone in scan_b
"scan_a": { "severity": "medium" /* ... */ },
"scan_b": null
}
]
}
Common use cases
| Scenario | How to use comparison |
|---|---|
| After a deployment | Compare the scan immediately before the deploy (baseline) against one run after — verify no regressions were introduced |
| After applying a patch | Confirm the targeted finding appears in Resolved and no new issues appeared in Added |
| Weekly monitoring | Schedule weekly scans (see Scheduled Scans) and compare each Monday's scan against the previous week |
| Auditor evidence | Use the diff API (GET /api/scan/SCAN_A_ID/diff/SCAN_B_ID) and export the full scan PDF reports to demonstrate remediation progress |