--- title: How GitLab tracks vulnerabilities through refactors and... description: GitLab describes an improvement to its Scope+Offset vulnerability fingerprinting method that ignores non-functional code changes like comments and blank lines... canonical: https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How GitLab tracks vulnerabilities through refactors and reformatting | daily.dev og:description: GitLab describes an improvement to its Scope+Offset vulnerability fingerprinting method that ignores non-functional code changes like comments and blank lines... og:url: https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz og:image: https://api.daily.dev/og/posts/UTWaTR5sz.png og:image:alt: How GitLab tracks vulnerabilities through refactors and reformatting og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How GitLab tracks vulnerabilities through refactors and reformatting **[GitLab](https://daily.dev/sources/gitlab)** · 5 min read · 0 upvotes · 0 comments ## Summary GitLab describes an improvement to its Scope+Offset vulnerability fingerprinting method that ignores non-functional code changes like comments and blank lines when computing a finding's identity. The original method, introduced in 2022, tracked findings by scope plus line offset but still broke when non-functional edits shifted line counts, causing duplicate findings. The normalized method, shipped as the scope_offset_compressed tracking algorithm supporting C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP, eliminated duplicates in a benchmark of 2,247 commits where the original method produced 1,361 duplicate fingerprints. The approach is detailed in a research paper to be presented at the ASE 2026 Industry Showcase. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does GitLab's scope_offset_compressed tracking algorithm reduce duplicate vulnerability findings? It normalizes the Scope+Offset fingerprint by ignoring non-functional code such as comments and blank lines when computing a finding's offset within its enclosing scope. Because these lines don't affect program behavior, they no longer shift the fingerprint. In a benchmark of 2,247 commits inserting comments or blank lines near known vulnerabilities, the original method produced 1,361 duplicate fingerprints while the normalized method produced zero. _Teams tuning SAST pipelines to cut noisy re-triage can follow security tracking updates like this on daily.dev._ ### Which languages does GitLab's normalized Scope+Offset vulnerability tracking support? The scope_offset_compressed algorithm supports C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP. It reuses the parse tree the scanner already builds, so scan times are unaffected, and the security report format stays unchanged, letting it work alongside other SAST tools in a mixed toolchain. _Developers evaluating SAST coverage across polyglot codebases can track tooling changes like this via daily.dev._ ### How much did GitLab's original Scope+Offset fingerprinting method reduce futile re-auditing compared to line-based vulnerability tracking? It cut futile re-auditing effort by about 30% compared to line-based tracking. That method, introduced in 2022, identified findings by their narrowest enclosing scope plus a line offset rather than by file and line number, making tracking resilient to code moving within a file, though it still broke on non-functional edits like added comments. _Security teams weighing vulnerability-tracking approaches can follow developments like this on daily.dev._ ## Similar posts on daily.dev - [GitLab Bug Bounty Program policy updates](https://daily.dev/posts/gitlab-bug-bounty-program-policy-updates-3bq6inpd5) · GitLab · 1 upvotes · 0 comments - [GitHub expands application security coverage with AI‑powered detections](https://daily.dev/posts/github-expands-application-security-coverage-with-ai-powered-detections-ealox7aer) · GitHub Blog · 0 upvotes · 0 comments - [The Year the Vulnerability Backlog Changed Shape](https://daily.dev/posts/the-year-the-vulnerability-backlog-changed-shape-iktuhpxgp) · JFrog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#gitlab](https://daily.dev/tags/gitlab), [#devsecops](https://daily.dev/tags/devsecops) [View this post on daily.dev](https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How GitLab tracks vulnerabilities through refactors and reformatting","url":"https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz"},"datePublished":"2026-08-12T13:44:48.131Z","dateModified":"2026-08-12T13:45:25.764Z","description":"GitLab describes an improvement to its Scope+Offset vulnerability fingerprinting method that ignores non-functional code changes like comments and blank lines...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/89a9365b26f20f8de7b0cb97e02bb361?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/89a9365b26f20f8de7b0cb97e02bb361?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitLab","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitLab","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/3720ce340ca4435daef529abbf361b69","url":"https://daily.dev/sources/gitlab"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,gitlab,devsecops","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitLab","item":"https://daily.dev/sources/gitlab"},{"@type":"ListItem","position":3,"name":"How GitLab tracks vulnerabilities through refactors and reformatting"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-gitlab-tracks-vulnerabilities-through-refactors-and-reformatting-utwatr5sz#faq","mainEntity":[{"@type":"Question","name":"How does GitLab's scope_offset_compressed tracking algorithm reduce duplicate vulnerability findings?","acceptedAnswer":{"@type":"Answer","text":"It normalizes the Scope+Offset fingerprint by ignoring non-functional code such as comments and blank lines when computing a finding's offset within its enclosing scope. Because these lines don't affect program behavior, they no longer shift the fingerprint. In a benchmark of 2,247 commits inserting comments or blank lines near known vulnerabilities, the original method produced 1,361 duplicate fingerprints while the normalized method produced zero. Teams tuning SAST pipelines to cut noisy re-triage can follow security tracking updates like this on daily.dev."}},{"@type":"Question","name":"Which languages does GitLab's normalized Scope+Offset vulnerability tracking support?","acceptedAnswer":{"@type":"Answer","text":"The scope_offset_compressed algorithm supports C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP. It reuses the parse tree the scanner already builds, so scan times are unaffected, and the security report format stays unchanged, letting it work alongside other SAST tools in a mixed toolchain. Developers evaluating SAST coverage across polyglot codebases can track tooling changes like this via daily.dev."}},{"@type":"Question","name":"How much did GitLab's original Scope+Offset fingerprinting method reduce futile re-auditing compared to line-based vulnerability tracking?","acceptedAnswer":{"@type":"Answer","text":"It cut futile re-auditing effort by about 30% compared to line-based tracking. That method, introduced in 2022, identified findings by their narrowest enclosing scope plus a line offset rather than by file and line number, making tracking resilient to code moving within a file, though it still broke on non-functional edits like added comments. Security teams weighing vulnerability-tracking approaches can follow developments like this on daily.dev."}}]} ```