GitLab's Innovative Vulnerability Tracking System
Method improves vulnerability tracking accuracy by 43% across code changes
1Core issue in security scanning
Traditional security scanners often flag simple edits like file formatting or comments as new vulnerabilities. This forces security teams to retriage issues they've already reviewed. Data from 2022 shows these false positives waste 30% of security teams' time and erode trust in scan results. GitLab's engineering team identified this as a major pain point in DevOps workflows.
2Birth of Scope+Offset method
GitLab engineers developed the Scope+Offset fingerprinting method to accurately track vulnerabilities across code changes. Unlike line-number-based systems, it identifies issues by their narrowest enclosing scope (module, class, function) plus position within that scope. Tested across 8 programming languages, this approach showed 30% better accuracy when code gets moved within files.
3The remaining gap
The initial version didn't account for non-functional changes like comments and whitespace. Adding a comment above a vulnerability would shift its position offset, making the system detect it as a new issue. For example, inserting a comment above a Java vulnerability caused duplicate tracking, creating unnecessary work for security teams.
4Normalized solution
The improved method ignores non-functional code (comments, whitespace) in fingerprint calculations. This maintains consistent vulnerability identification regardless of formatting changes. In tests across 439 source files, the normalized approach produced zero false positives while reducing unique fingerprints by 43% compared to the original method.
5Rigorous testing process
The team tested 2,247 commits across 7 languages (C/C++, C#, Go, Java, JavaScript, Python, Ruby). Each commit added a single comment or blank line directly above known vulnerabilities to simulate worst-case scenarios. While the original method generated 1,361 duplicate fingerprints, the normalized version showed zero duplicates.
6Technical implementation
The normalized Scope+Offset algorithm ships in GitLab as scope_offset_compressed, supporting C#, C/C++, Go, Java, JavaScript, Python, Ruby and PHP. It reuses the scanner's existing parse tree, maintaining original scan speeds. The security report format remains unchanged, ensuring compatibility with various SAST tools in heterogeneous environments.
7Academic recognition
The research paper 'Vulnerability Tracking using Normalized Scope+Offset' by Julian Thome, Hua Yan, Lucas Charles, Craig Smith, and Jason Leasure will be presented at ASE 2026 Industry Showcase. The work establishes new standards for vulnerability tracking accuracy that could influence future security tools across the industry.
8Industry impact
This innovation is particularly valuable for teams working with large codebases. Security teams can focus on real threats rather than retriaging known issues, while developers gain freedom to make non-functional changes. The approach may become a new benchmark for vulnerability tracking in enterprise software development.
Original article: GitLab — GitLab'ın Yenilikçi Güvenlik Açığı Takip Sistemi