Vulnerability Tracking using Normalized Scope+Offset

Abstract

In heterogeneous Static Application Security Testing (SAST) setups, multiple tools continuously monitor code changes to detect security vulnerabilities. Vulnerability Tracking deduplicates and tracks these vulnerabilities throughout a project’s lifetime, reducing futile auditing caused by code volatility and double reporting. In prior work, we introduced the Scope+Offset method which identifies vulnerabilities based on a scope and offset fingerprint, reducing futile auditing by approximately 30%. However, the offset component is sensitive to non-functional code changes such as added comments or whitespace, which can cause spurious duplication. In this paper, we present Scope+OffsetN, an improved method that normalizes the offset computation by excluding non-functional source code lines. We detail the normalization algorithm and demonstrate its correctness on worked examples; on a targeted public benchmark it reduces unique fingerprints by 43%. Scope+OffsetN has been deployed in GitLab since May 2025, providing tracking to thousands of daily security scans.