Delta scans

A delta Deep Scan checks changed files and stale or unverified points on your Attack surface map. It updates the existing map between full scans.

​

Why use delta scans

Your code keeps changing after a Deep Scan, and each change makes part of your attack surface map out of date. A full Deep Scan refreshes everything, but it also rechecks code that has not changed. A delta scan rechecks files changed since the latest complete full or delta scan, plus mapped points that are stale or were never verified.

• Pay for the work done. Cost depends on both changed files and stale or unverified points that need rechecking. The scan dialog shows the estimate before you run it.
• Keep coverage current between full scans. Findings in changed files are rechecked and the map is updated with the scan’s results.
• Scan when coverage drops. With automation, CodeRabbit runs a delta only when verified coverage drops below your target. A regular full-scan schedule does not depend on coverage.

Run a full Deep Scan for broad repository changes or a fresh baseline.

​

Before you begin

• Use CodeRabbit Cloud with a plan that includes continuous coverage.
• Start with a completed full Deep Scan of the repository from the last 30 days. Your coverage must meet the minimum shown in the scan dialog.
• You need Security write access and access to the repository.

​

Run a delta scan

​

Automate delta scans

For GitHub repositories, open Automate delta scans, set Keep verified coverage above to your target, and select Turn on automation. CodeRabbit checks coverage on a schedule. It also tries to check after changes merge into the default branch. If a merge check fails, the next scheduled check or a later merge can trigger a scan. A scan runs only when coverage is below your target and the scan and billing requirements are met. To stop future checks, open Manage automation and turn it off.

​

Billing and results

You pay for the work the delta scan performs. To start a delta, your credits or monthly limit must cover the full-scan estimate. CodeRabbit returns whatever the delta does not use. A billing admin must approve paid runs. See Security usage and limits. Track results in Security > Scan history. A delta rechecks findings in the files it scans. If the baseline expires, coverage is too low, or more than 40% of the source files included by your scan settings have changed, run a full Deep Scan.

​

What’s next