vulkro diff

Compare the current API surface and findings against a saved scan or a git ref. Produces a per-finding delta - added, fixed, unchanged.

Usage

vulkro diff [BASE] [PATH] [--format FMT]

Arguments

Argument	Description	Default
BASE	Git ref or saved-scan label to compare against.	main
PATH	Project root.	.

How matching works

Findings are matched by a stable finding_key rather than file/line, so reordering a function or adding a new line above a finding doesn't generate spurious "added" / "removed" pairs.

Use case: review API-surface changes vs main

# Print endpoints and findings that changed vs origin/main
vulkro diff origin/main

vulkro diff reports the surface delta; it does not fail the build on its own. To gate a PR on findings that are new vs a base ref, use vulkro gate --base, the canonical fail-on-new-only gate. Together they are the typical "block PRs on regressions, ignore long-tail tech debt" CI pattern.

Output formats

table (default), json, gh-pr (markdown for gh pr comment), junit, and csv. The gh-pr format groups by added / fixed and suppresses unchanged.

Related

• vulkro scan --gate-vs
• vulkro history
• See also: Baselines explained - vulkro diff is the third comparison flavour alongside the CLI baseline file and the UI's baseline-scan flag.

Related commands

vulkro history

Lists saved scans:

vulkro history

Add --save to a scan run to populate it.

vulkro trends

Shows risk-score, finding-count, MTTR, and risk-debt deltas across the saved history:

vulkro trends . --limit 30