Automated Regression Testing

What is automated regression testing?

When you mark a vulnerability as resolved, Shieldome does not just take your word for it. It schedules an automatic follow-up scan of that specific finding and notifies you if the issue has come back. This closes the loop between your security team and your developers - no more "fixed in staging, broken in production" surprises.

🔁

Passive verification. The regression check runs a targeted re-scan using the same passive detection method as the original finding. It does not attempt to exploit anything - it looks for the same observable signals that triggered the original alert.

How it works

Mark as resolved. In the findings panel, set a finding's status to Resolved. Shieldome records the fix timestamp and schedules a verification scan 24 hours later.
Automatic check. An hourly background task picks up any checks that are due. It runs a quick scan against the target URL looking for the same vulnerability.
Result recorded. The check is marked confirmed_fixed if the signal is gone, or regressed if it is still present.
Finding reopened. If a regression is detected, the original finding is automatically reopened (status reset to open) and you receive a notification.

Result	Meaning	Action taken
confirmed_fixed	The vulnerability signal is no longer present	None - check is closed
regressed	The vulnerability was reintroduced	Finding reopened, notification sent, AI explanation generated
error	The target was unreachable or the scan failed	Check recorded, finding left in resolved state

AI-powered explanation

When a regression is detected, Shieldome uses its AI assistant to generate a plain-English explanation of why the vulnerability is still observable and what the likely cause of the regression is. This helps developers understand the context without having to re-read a technical finding description.

Viewing regression checks

You can see all scheduled and completed regression checks via the REST API:

GET /api/me/regression-checks
GET /api/scan/{scan_id}/regression-checks

Each record includes the finding name, scheduled check time, actual check time, result, and the AI explanation if a regression was detected.

Timing

The first check runs 24 hours after you mark a finding as resolved.
Checks run on an hourly sweep - your check fires within one hour of its scheduled time.
Currently one check is performed per resolved finding. If the finding is manually reopened and re-resolved, a new check is scheduled.

⚠

Requires an active subscription. Regression checks run as part of your monitored domain plan. The check re-uses your scan credits.

Frequently asked questions

Can I trigger a regression check immediately?

Not yet - the check runs on the scheduled cadence. You can always run a manual scan of the target and compare results.

What if the target URL has changed?

The check runs against the original target URL stored on the scan. If the URL is no longer valid, the check is recorded with status error.

Does this work for all finding types?

Yes - the regression check re-runs the same passive detection that produced the original finding. Some findings (like missing security headers) are quick to verify; others (like blind SQL injection indicators) may have limited re-check depth in quick-mode.