security v3.1.0 - Suppressions, Diff Scanning, Results

security v3.1.0 — Workflow Features

Three features that turn the scanner from a one-shot tool into a workflow:

Suppression System

Persistently suppress false positives across scans via .security/suppressions.json:

/security:scan --suppress finding-003   # Mark as false positive
/security:scan --show-suppressed        # Include suppressed in report

Suppressions match by rule_id, file pattern (glob), and/or CWE.

Diff-Only Scanning

Scan only changed files for fast PR review workflows:

/security:scan --diff                   # Changed vs main branch
/security:scan --diff-base HEAD~3       # Changed in last 3 commits

Results Viewer

View last scan results without re-running:

/security:results

Shows report age and suggests re-scan if stale (>24 hours).

Also Included

• Deterministic ordering fixes (Gitleaks/Trivy sorted by file+line)
• Stricter triage guidance (decision tree, fixed severity table)
• SCRIPT_DIR fix in correlate.sh