From d654266b3e9eec4e8611ff053de3107a475a2fd2 Mon Sep 17 00:00:00 2001 From: Anso Date: Fri, 17 Apr 2026 14:23:38 -0400 Subject: [PATCH] chore(security): add diagnostic log to scan compare handler (#663) Emit a [Compare:diag] entry gated on developer_mode with the scan ids, effective tier, input and bucket sizes, suppression count, and truncation flag. Gives operators a trace to correlate with user reports of unexpected compare results without adding hot-path cost. --- backend/src/index.ts | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/backend/src/index.ts b/backend/src/index.ts index a6f04e3d..c89bff39 100644 --- a/backend/src/index.ts +++ b/backend/src/index.ts @@ -8008,6 +8008,21 @@ app.get('/api/security/compare', authMiddleware, (req: Request, res: Response): const added = applySuppressions(addedRaw, b.image_ref, suppressions); const removed = applySuppressions(removedRaw, a.image_ref, suppressions); const unchanged = applySuppressions(unchangedRaw, b.image_ref, suppressions); + if (isDebugEnabled()) { + console.log('[Compare:diag]', { + scanId1, + scanId2, + reqNodeId: req.nodeId, + tier: req.proxyTier ?? LicenseService.getInstance().getTier(), + aVulns: aVulns.length, + bVulns: bVulns.length, + added: added.length, + removed: removed.length, + unchanged: unchanged.length, + suppressions: suppressions.length, + truncated, + }); + } res.json({ scanA: { id: a.id,