How GitLab tracks vulnerabilities through refactors and reformatting
Aug 12, 2026Julian Thome

Summary
Introduced a normalized Scope+Offset fingerprinting method for vulnerability tracking that ignores non-functional code (comments and blank lines). This significantly reduces duplicate vulnerability reports caused by code refactoring and reformatting, as demonstrated by a benchmark showing zero duplicates and a 43% reduction in unique fingerprints compared to the original Scope+Offset method. The `scope_offset_compressed` algorithm is now the default for SAST tools in GitLab, supporting multiple languages and reusing existing parse trees with no impact on scan times.