Security work is done for the person who comes next, not for today. A system ships with its input list, its suite, its scores, and its open cases, so the next person starts from facts instead of a guess.
About 1 min of reading
Merge a defence change with its artefacts
Run the suite and store the score
Before you run it, say out loud what it will print. Then open the answer.
List the open cases
Before you run it, say out loud what it will print. Then open the answer.
Refuse a merge with no score
Before you run it, say out loud what it will print. Then open the answer.
A document nobody opens is a document that is not there. Files next to the code are read by the people who change it.
Some cases stay open. That is the honest end state, and shipping it says the limit of what this system can promise.
Input table, attack suite, last scores, open cases. Four files, and they are the whole state of the defence.
An open case is a known weakness. Hiding it means the next person rediscover it from a user complaint instead.
No defence change is merged without a suite run. That rule is why every score since is comparable.
Each one is defined here on this site. Open the entry for the full definition and the other words it points at.