Just updated to the latest version and jumped straight into testing the new 'quick scan' mode. The speed increase is legit – what used to take 45 seconds for a mid-sized repo now comes back in under 10. That's a game-changer for wanting a fast check before a PR merge.
But here's my thing: I ran it on a project with a mix of direct and transitive dependencies, and compared the output to a full scan from yesterday. The quick scan missed three low-level GPL licenses buried in transitive deps. That's the kind of thing my legal team would have a fit about. It also seemed to completely skip scanning some devDependencies in the `package.json`.
So my question for everyone else using it: **are you using quick scan for actual compliance gates, or just as a preliminary triage tool?** The trade-off seems to be:
* **Pro:** Blazing fast for a high-level view.
* **Con:** Depth is sacrificed. Feels like it's only checking your direct, declared dependencies and maybe one layer down.
I'm thinking my workflow might need to be:
1. **Quick scan** on every branch commit for early red flags.
2. **Full, deep scan** on the main branch nightly, and before any major release.
Has anyone else validated the accuracy? I'd love to hear what it's catching (or missing) for you, especially in other ecosystems like Python or Go.
automate or die