Regressions: what it means when a fix comes undone
A regression is a finding that was open, was resolved, and has matched again. RowShield marks the transition explicitly rather than raising it as brand-new, because the second occurrence carries different information from the first.
The first occurrence says the schema had a hole. The second says the way holes get closed is unreliable — which is uncomfortable, and far more valuable to know.
What a regression says about process
Fixes come back for predictable reasons. The most common: the remedy was applied by hand in the dashboard console instead of being written into a migration, so the next deploy rebuilt the old state and quietly undid the work. A branch merged over the top of a fix, or an environment synced from a stale snapshot, achieves the same result.
None of these are exotic. They are ordinary release habits colliding with a database that remembers less than the repository does. A regression is the receipt for that collision, arriving while the context is still fresh enough to trace it — and it is kinder evidence than a hunch, because the transition records when the fix vanished and against which scan, which usually narrows the suspect deploy to one.
Making fixes stick
The reliable pattern is boring: take the remediation SQL from the finding, put it in a migration alongside whatever introduced the problem, and let the normal deploy path carry both. Then let continuous integration hold the line — the command-line interface exits non-zero when a rule above your chosen severity matches, so a pull request that reintroduces the hole fails its checks before it merges.
Watch the regression count on a project the way a lead watches flaky tests. One regression is an incident; a pattern of them is a process finding, and it responds to the same medicine: fewer hand-applied changes, more migrations, and a gate that runs on every merge. The gate is cheap insurance: seconds per merge against hours of archaeology later.
Related questions
- Is a regressed finding more severe than a new one?
- The severity is a property of the rule and stays the same either way. What changes is confidence: a regression proves the environment can undo fixes, which is worth treating as its own incident.
- We resolved a finding but it shows as regressed immediately. Why?
- Most often the fix was applied somewhere other than the scanned database — a staging project, a different branch, a transaction that rolled back. Check that the resolution landed where the connection string points.
Did this answer your question? If not, tell us what is missing — article corrections go straight to the person who maintains it.