To explain this behavior to ensure we're accomplishing the objective properly:
If something flags on a new rule regardless we want to know about it. It should use whatever the most recent scan is to reference whether or not it has new behaviors.
e.g.:

numpyv1: rules matched [code marshaling]
numpyv2: rules matched [code marshaling] # doesn't flag
numpyv3: rules matched [code marshaling, malware] # does flag, new rule
numpyv4: rules matched [code marshaling, malware] # doesn't flag

Package flags should always reference the last seen version of the package to determine whether or not it will flag again.
New rule commits should generate new flags. If a rule is renamed and subsequently flags on a package, I consider this a potential benefit due to the ability to rename a rule with, say, a version number and have it be treated as an entirely unique rule.

The feature @import-pandas-as-numpy needs to be implemented in the GET /package endpoint - we should be able to add a UNIQUE constraint to the returned rules so we don't return multiple versions that flagged on the same rule

Closing this for now as it seems there was a misunderstanding on what the specification for #61 was. This may yet be a feature we want, and we will re-open it in the future after it's been discussed. Thanks all!