How GitLab tracks vulnerabilit... Note
GitLab

How GitLab tracks vulnerabilities through refactors and reformatting

Security scans often face the problem of reporting the same vulnerability twice due to minor changes in the code, such as adding a comment or reformatting a file. This leads to futile auditing effort and erodes trust in the scan results. To tackle this issue, advanced vulnerability tracking was introduced in 2022, which uses the Scope+Offset fingerprinting method to identify findings by their narrowest enclosing scope and line offset. However, this method still had limitations, particularly with non-functional changes such as adding comments or blank lines, which could shift the offset and cause the tracker to see a duplicate vulnerability. To address this, an improved method was developed that ignores non-functional code when computing the fingerprint, ensuring that adding a comment or reformatting a file no longer changes the fingerprint. This normalized method was evaluated on a benchmark of 439 source files across multiple programming languages, where it produced zero duplicates and reduced unique fingerprints by 43% overall. The original Scope+Offset method, on the other hand, accumulated 1,361 duplicate fingerprints, a 77% growth over the baseline. The normalized Scope+Offset method is now available in GitLab as the scope_offset_compressed tracking algorithm, supporting multiple programming languages and composing with any combination of SAST tools. The study on this method, titled "Vulnerability Tracking using Normalized Scope+Offset," will be presented at the ASE 2026 Industry Showcase, and its findings have significant implications for improving the accuracy and efficiency of security scans. The development of this method is a result of collaboration among several researchers, including Julian Thome, Hua Yan, Lucas Charles, Craig Smith, and Jason Leasure, who contributed to the study and article.