Home / Help centre / Results & findings
Results & findings
Why did a finding I fixed come back as a Regression?
When an issue you marked Fixed shows up again in a later scan, Cyberlop flags it as a Regression instead of creating a fresh finding. That means the fix did not hold, or a later change reopened the flaw. Read the new evidence, patch again, and re-scan.
Why this happens
Dispositions are respected across scans. A fixed issue that reappears becomes a Regression, not a brand-new finding. That keeps its history intact and tells you, at a glance, that this exact issue has been here before and was closed.
Causes are usually plain:
- The first fix covered one path, while the same flaw lives on another path that nobody checked at the time.
- A later deploy or merge undid the fix. It happens often.
- The scan read an older branch or build than the one you expected it to read.
- The earlier Fixed label came from a scan that tested less, not from a real patch.
How to fix it
- Open the finding and click the Evidence tab. Study the payload, request and response from the latest scan.
- Note the Location on the Summary tab. It names a file and line for a code finding, or an endpoint for a live one.
- Compare that place with your last fix. Look for a second route, a reverted commit or a missing branch.
- Patch the cause, then deploy it. Fix the root, not just the one request in the payload.
- Re-scan the same profile. Open Diff. A real fix moves the issue to Fixed.
Still not working?
Before you assume the scanner is wrong, confirm that it looked at the code you think it did, because a scan of an old branch will happily report old flaws. Check the target branch on the target page. A target cannot be edited, so a wrong branch means a new target. Our page on wrong branch scanned has the steps. If the evidence looks wrong, mark it a false positive and explain why in Notes. You can also contact us. For the bigger picture, read the fixed and regressed tutorial.
Related questions
- How do I find findings that came back after being fixed?
- Why was a finding marked Fixed when I didn't change it?
- Will a finding I marked as a false positive come back on the next scan?
- Why did my scan test the main branch instead of my feature branch?
- How do I mark a finding as a false positive?
How to verify a vulnerability fix with fixed and regressed issues
Step-by-step, with annotated screenshots.
Updated · Back to the help centre
Still stuck?
Tell us what you see on screen and an engineer will help you sort it out.