Pull-request diff scanning is the practice of reviewing only the lines added, removed, or modified in a pull request instead of reanalyzing the entire repository. Security tools use the diff as a focused view of what is changing, which helps reviewers catch risky edits early and reduce noise from unrelated legacy code.
It matters because many real attacks begin with a small code change: a weakened input check, a dangerous file operation, a modified dependency, or a backdoor hidden in a subtle logic tweak. By checking the diff before merge, teams can block insecure changes, require human review for sensitive paths, and automate policy enforcement in CI. Diff scanning is strongest when paired with broader repository scans, since some vulnerabilities only become visible in the context of surrounding code.