Posture Drift

Every scan is automatically saved to a local SQLite database. StackSentry compares your current scan against the previous one for the same target, surfacing what improved, what regressed, and what is new.

How It Works

# Run normally — scan is saved automatically
stacksentry -t https://your-app.com --mode full
 
# Run again later — drift is computed automatically
stacksentry -t https://your-app.com --mode full
 
# Explicitly compare against last scan
stacksentry -t https://your-app.com --compare-last

Drift Report Output

━━  Security Posture Drift  ━━━━━━━━━━━━━━━━━━━━━━━━
  Previous scan:  2026-04-10  Grade: F (45.5%)
  Current scan:   2026-04-11  Grade: C (72.7%)
  Grade delta:    +27.2%  ↑ Improving
 
  Improvements (4):
    ✅ WS-HSTS-001   FAIL → PASS   HSTS header added
    ✅ WS-SEC-001    FAIL → PASS   Security headers added
    ✅ WS-SRV-001    FAIL → PASS   Server token hidden
    ✅ HOST-SSH-001  FAIL → PASS   SSH hardened
 
  Regressions (0):
    — none —
 
  New failures (0):
    — none —
 
  Trend: IMPROVING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Trend Indicators

Storage Location

Scan history is stored at:

~/.stacksentry/history.db

Override with:

stacksentry -t https://your-app.com --db-path /path/to/custom.db

Continuous Monitoring

Run StackSentry on a schedule (cron, GitHub Actions, etc.) with --compare-last to surface regressions automatically:

# Example cron — weekly scan with drift check
0 9 * * 1 stacksentry -t https://your-app.com --mode full \
  --compare-last -o /reports/week-$(date +\%Y\%W).pdf

Skipping History

To run a scan without saving it to history:

stacksentry -t https://your-app.com --no-save

Useful for exploratory or test scans you do not want polluting the baseline.