Same Code, Three Runs: What --rci 2 Did to the Findings
A plugin update for stride-security-review shipped today, so I ran it against Trays Social without changing a line of application code. Then I ran it again. Same plugin version, same files, different counts and, more importantly, different reads on whether there was a Critical at all.
- Run 1 (single-pass): 44 findings, 0 Critical, 2 High.
- Run 2 (single-pass): 40 findings, 1 Critical, 2 High.
- Run 3 (
--rci 2): 33 findings, 1 Critical, 3 High.
--rci 2 adds two extra critique passes (the flag is clamped to a max of 3). After that the picture settled.