I'm using the plugin in a Maven multi-module project, where I configured a post-build step to invoke it and a post-build action to publish the report.

Using the post-build step with the default configuration only two "random" vulnerabilities are found, while if I execute manually "mvn org.owasp:dependency-check-maven:check" from the base of the mult-module project a report is created for each module (with many more issues found).

Am I missing something?