sc-diff-report

SC: Diff Report — Incremental Security Scan

Purpose

Performs a targeted security scan on only the files changed in a git diff, pull request, or recent commit. This enables fast, focused security feedback during code review without the overhead of a full codebase scan. Classifies findings as "new" (introduced by changes) vs "existing" (pre-existing in touched files).

Activation

Activates when the user issues any of:

• "scan diff"
• "scan changes"
• "PR scan"
• "scan commit"
• "incremental scan"

Output

File: security-report/diff-report.md

Phase 1: Change Detection

Git Diff Extraction

Determine the diff scope based on user context:

PR Mode (most common):

git diff main...HEAD --name-only
git diff main...HEAD

Staged changes:

git diff --cached --name-only
git diff --cached

Last commit:

git diff HEAD~1 --name-only
git diff HEAD~1

Custom range:

git diff {base}...{head} --name-only
git diff {base}...{head}

Changed File Inventory

From the diff output, build an inventory:

1. Added files — entirely new files (highest priority)
2. Modified files — existing files with changes
3. Deleted files — removed files (check for orphaned references)
4. Renamed files — detect renames with content changes

For each changed file, record:

• File path
• Change type (added/modified/deleted/renamed)
• Lines added (line numbers)
• Lines removed (line numbers)
• Total change size (lines added + removed)

Change Filtering

Filter out changes unlikely to have security impact:

• Documentation files (.md, .txt, .rst) — skip unless they contain config
• Test files — scan but mark as test context
• Generated files — skip (check for generated markers)
• Lock files — delegate to sc-dependency-audit pattern matching
• Static assets (images, fonts, CSS) — skip
• Configuration files — keep, high priority for security review

Dependency Change Detection

If lock files or manifests changed:

• package.json / package-lock.json — extract added/removed/updated packages
• go.mod / go.sum — extract module changes
• Cargo.toml / Cargo.lock — extract crate changes
• requirements.txt / poetry.lock — extract package changes
• Flag newly added dependencies for supply chain review