Match equivalent findings across Standard and Deep scans

[soyeon-oai]

Standard and Deep scans of the same repository revision can assign different identity.anchor values to the same vulnerability. Consequently, scans compare may report the previous finding as unknown and the equivalent new finding as newly introduced.

Reproduction: run both scan modes against the same synthetic vulnerable repository, then compare their results.

Expected: equivalent findings with matching vulnerability families and source locations remain identifiable across scan modes.

[su-jin1425]

Hi, I’d like to work on this issue. I’ll investigate how identity.anchor is generated across Standard and Deep scans, identify why equivalent findings receive different anchors, and add a fix with regression tests. I’ll share my plan ASAP. Please confirm before I start investigating and implementing a fix.