Now sorting done on client side in projects list, which means that globally results are always sorted in alphabetical order, and user can change sorting within one page of results only. The idea is to allow users to see vulnerable projects first, without need going through all pages to see vulnerable projects.
This can be done by:
moving vulnerable projects to the beginning of the list (keeping alphabetic sorting within 2 parts) - always or by separate UI trigger “Show vulnerable projects first“
adding page-global sorting by vulnerabilities list (in this case user may expect the same behavior for other pages / columns)
Implementation note: Bitbucket API doesn't support selecting page of projects with custom sorting. We can request whole projects list and sort it manually, then enrich requested page with scan data, but this should be tested with several hundreds of projects in sense of performance. Probably new redundant PROJECT_SCAN table will be needed.