I have submitted my org a week before in Security scanner and it was in queue for a long time. After which I updated our apex codes in the submitted org. So I would like to know whether updated code will be scanned or the existing code which was submitted during submitted date?
I had a call with CheckMarx customer care.
He mentioned that if the submitted org is in queue then it is not yet scanned. So on the time of scanning whatever code available in the org will be scanned regardless of queue.
ie)Checkmarx report contains the time it started scan. That is the version scanned at that moment.
For race conditions such as these, since loose code is scanned and not a package version, I would recommend running another scan if you think the code changes are large enough to warrant it. My guess is that the old version of your code got scanned, but there just isn't a way to tell.