GitLab

How GitLab tracks vulnerabilities through refactors and reformatting

Aug 12, 2026Julian Thome
How GitLab tracks vulnerabilities through refactors and reformatting
SummaryAI, from the source post

Introduced a normalized Scope+Offset fingerprinting method for vulnerability tracking that ignores non-functional code (comments and blank lines). This significantly reduces duplicate vulnerability reports caused by code refactoring and reformatting, as demonstrated by a benchmark showing zero duplicates and a 43% reduction in unique fingerprints compared to the original Scope+Offset method. The `scope_offset_compressed` algorithm is now the default for SAST tools in GitLab, supporting multiple languages and reusing existing parse trees with no impact on scan times.

More from the AI-Assisted Features in DevSecOps trail