How GitLab tracks vulnerabilities through refactors and reformatting

Every day, security scans face the same problem: an agent or a developer adds a comment, reformats a file, or moves a function, and a naive vulnerability tracker suddenly reports the same finding twice. Security teams end up re-triaging issues they already dismissed, which causes futile auditing effort and erodes trust in the scan results.

In 2022, we introduced advanced vulnerability tracking to tackle exactly this problem of code volatility. It is based on our Scope+Offset fingerprinting method: instead of identifying a finding by file and line number, we identify it by its narrowest enclosing scope (module, class, function) plus its line offset within that scope. That made tracking robust against code moving around the file and reduced futile re-auditing by about 30% compared to line-based tracking.

But one class of edits still slipped through: non-functional changes. The offset counted every line between the scope boundary and the finding, including comments and blank lines. Add a comment above a vulnerable statement, and the offset shifts. The tracker sees a "new" vulnerability; you see a duplicate.

Our improved method addresses this by simply ignoring non-functional code (comments and blank lines) when computing the fingerprint. Since these lines do not affect the program's behavior, they should not affect the identity of a vulnerability either. With this normalization in place, adding a comment or reformatting a file no longer changes the fingerprint, while the precision of the tracking remains the same as before. The details of the approach are described in our accompanying research paper.

We evaluated the normalized method on a targeted benchmark: 439 source files across C/C++, C#, Go, Java, JavaScript, Python, and Ruby. We generated 2,247 commits, each inserting a single comment or blank line directly before a known vulnerability, and scanned the code as the history was replayed. The benchmark deliberately stresses the worst case: every commit is a non-functional edit right next to a finding.

On this benchmark, the original Scope+Offset method accumulated 1,361 duplicate fingerprints, a 77% growth over the baseline. The normalized method produced zero duplicates and reduced unique fingerprints by 43% overall.

Normalized Scope+Offset ships in GitLab as the scope_offset_compressed tracking algorithm, supporting C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP. It reuses the parse tree the scanner already constructs, so scan times are unaffected. The security report format is unchanged, so it composes with any combination of SAST tools in a heterogeneous setup.

The preprint of our study "Vulnerability Tracking using Normalized Scope+Offset" by Julian Thome, Hua Yan, Lucas Charles, Craig Smith, and Jason Leasure will be presented at the ASE 2026 Industry Showcase.

Hua Yan, Lucas Charles, Craig Smith, and Jason Leasure contributed to this article and study.