Vulnerability Tracking using Normalized Scope+Offset
TL;DR
This paper presents Scope+OffsetN, an improved method that normalizes the offset computation by excluding non-functional source code lines, and details the normalization algorithm and demonstrates its correctness on worked examples.
Abstract
In heterogeneous Static Application Security Testing (SAST) setups, multiple tools continuously monitor code changes to detect security vulnerabilities. Vulnerability Tracking deduplicates and tracks these vulnerabilities throughout a project’s lifetime, reducing futile auditing caused by code volatility and double reporting. In prior work, we introduced the Scope+Offset method which identifies vulnerabilities based on a scope and offset fingerprint, reducing futile auditing by approximately 30%. However, the offset component is sensitive to non-functional code changes such as added comments or whitespace, which can cause spurious duplication. In this paper, we present Scope+OffsetN, an improved method that normalizes the offset computation by excluding non-functional source code lines. We detail the normalization algorithm and demonstrate its correctness on worked examples; on a targeted public benchmark it reduces unique fingerprints by 43%. Scope+OffsetN has been deployed in GitLab since May 2025, providing tracking to thousands of daily security scans.