How GitLab tracks vulnerabilities through refactors and reformatting (opens in new tab)
GitLab improved vulnerability tracking to prevent duplicate findings after harmless code changes such as added comments, blank lines, or reformatting. Its normalized Scope+Offset fingerprint ignores non-functional lines while still identifying vulnerabilities by their enclosing scope and relative location. In testing, the method eliminated duplicates in a worst-case benchmark and is now available as `scope_offset_compressed`. ## The Problem with Line-Based Tracking - Vulnerabilities can appear to be new when developers: - Add comments or blank lines - Reformat files - Move functions or other code - Duplicate findings force security teams to repeat triage and reduce confidence in scan results. - GitLab’s 2022 Scope+Offset method improved on line-based tracking by using: - The narrowest enclosing scope, such as a module, class, or function - The finding’s line offset within that scope - This reduced unnecessary re-auditing by about 30%, but comments and blank lines could still change the offset. ## Normalized Scope+Offset Fingerprinting - The improved method ignores comments and blank lines when calculating a vulnerability’s fingerprint. - Because these lines do not change program behavior, they no longer change the vulnerability’s identity. - The approach preserves the previous method’s precision and reuses the scanner’s existing parse tree, so scan times are unaffected. - It does not require changes to the security report format and works with heterogeneous SAST toolchains. ## Benchmark Results - Researchers tested 439 source files across: - C/C++, C#, Go, Java, JavaScript, Python, and Ruby - They generated 2,247 commits, each adding a comment or blank line immediately before a known vulnerability. - The original method produced 1,361 duplicate fingerprints, representing a 77% increase over baseline. - The normalized method produced zero duplicates and reduced unique fingerprints by 43%. ## GitLab Availability - The algorithm is available in GitLab as: - `scope_offset_compressed` - It supports C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP. - The accompanying research paper, *Vulnerability Tracking using Normalized Scope+Offset*, is scheduled for presentation at the ASE 2026 Industry Showcase. For teams using GitLab security scanning, `scope_offset_compressed` provides more stable vulnerability tracking without slowing scans or changing existing report integrations.