[{"data":1,"prerenderedAt":888},["ShallowReactive",2],{"/blog/categories/security/page/9":3,"navigation-en-us":20,"banner-en-us":447,"footer-en-us":457,"security-category-page-total-items-en-us":702,"security-category-page-featured-en-us":703,"security-category-page-9-en-us":828},{"id":4,"title":5,"body":6,"category":6,"config":7,"content":11,"description":6,"extension":12,"meta":13,"navigation":14,"path":15,"seo":16,"slug":6,"stem":18,"testContent":6,"type":6,"__hash__":19},"blogCategories/en-us/blog/categories/security.yml","Security",null,{"template":8,"slug":9,"hide":10},"BlogCategory","security",false,{"name":5},"yml",{},true,"/en-us/blog/categories/security",{"title":5,"description":17},"Browse articles related to Security on the GitLab Blog","en-us/blog/categories/security","Hx58KagneyLDkWgUOsPQNGCsWqekf9YGQa6EJFfGFRw",{"logo":21,"freeTrial":26,"sales":31,"login":36,"items":41,"search":367,"minimal":398,"duo":417,"switchNav":426,"pricingDeployment":437},{"config":22},{"href":23,"dataGaName":24,"dataGaLocation":25},"/","gitlab logo","header",{"text":27,"config":28},"Get free trial",{"href":29,"dataGaName":30,"dataGaLocation":25},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com&glm_content=default-saas-trial/","free trial",{"text":32,"config":33},"Request a demo",{"href":34,"dataGaName":35,"dataGaLocation":25},"/sales/?contact-topic=request-demo","sales",{"text":37,"config":38},"Sign in",{"href":39,"dataGaName":40,"dataGaLocation":25},"https://gitlab.com/users/sign_in/","sign in",[42,71,170,175,289,345],{"text":43,"config":44,"menu":46},"Platform",{"dataNavLevelOne":45},"platform",{"type":47,"columns":48},"cards",[49,55,63],{"title":43,"description":50,"link":51},"The intelligent orchestration platform for DevSecOps",{"text":52,"config":53},"Explore our Platform",{"href":54,"dataGaName":45,"dataGaLocation":25},"/platform/",{"title":56,"description":57,"link":58},"GitLab Duo Agent Platform","Agentic AI for the entire software lifecycle",{"text":59,"config":60},"Meet GitLab Duo",{"href":61,"dataGaName":62,"dataGaLocation":25},"/gitlab-duo-agent-platform/","gitlab duo agent platform",{"title":64,"description":65,"link":66},"Why GitLab","See the top reasons enterprises choose GitLab",{"text":67,"config":68},"Learn more",{"href":69,"dataGaName":70,"dataGaLocation":25},"/why-gitlab/","why gitlab",{"text":72,"left":14,"config":73,"menu":75},"Product",{"dataNavLevelOne":74},"solutions",{"type":76,"link":77,"columns":81,"feature":149},"lists",{"text":78,"config":79},"View all Solutions",{"href":80,"dataGaName":74,"dataGaLocation":25},"/solutions/",[82,106,128],{"title":83,"description":84,"link":85,"items":90},"Automation","CI/CD and automation to accelerate deployment",{"config":86},{"icon":87,"href":88,"dataGaName":89,"dataGaLocation":25},"AutomatedCodeAlt","/solutions/delivery-automation/","automated software delivery",[91,95,98,102],{"text":92,"config":93},"CI/CD",{"href":94,"dataGaLocation":25,"dataGaName":92},"/solutions/continuous-integration/",{"text":56,"config":96},{"href":61,"dataGaLocation":25,"dataGaName":97},"gitlab duo agent platform - product menu",{"text":99,"config":100},"Source Code Management",{"href":101,"dataGaLocation":25,"dataGaName":99},"/solutions/source-code-management/",{"text":103,"config":104},"Automated Software Delivery",{"href":88,"dataGaLocation":25,"dataGaName":105},"Automated software delivery",{"title":5,"description":107,"link":108,"items":113},"Deliver code faster without compromising security",{"config":109},{"href":110,"dataGaName":111,"dataGaLocation":25,"icon":112},"/solutions/application-security-testing/","security and compliance","ShieldCheckLight",[114,118,123],{"text":115,"config":116},"Application Security Testing",{"href":110,"dataGaName":117,"dataGaLocation":25},"Application security testing",{"text":119,"config":120},"Software Supply Chain Security",{"href":121,"dataGaLocation":25,"dataGaName":122},"/solutions/supply-chain/","Software supply chain security",{"text":124,"config":125},"Software Compliance",{"href":126,"dataGaName":127,"dataGaLocation":25},"/solutions/software-compliance/","software compliance",{"title":129,"link":130,"items":135},"Measurement",{"config":131},{"icon":132,"href":133,"dataGaName":134,"dataGaLocation":25},"DigitalTransformation","/solutions/visibility-measurement/","visibility and measurement",[136,140,144],{"text":137,"config":138},"Visibility & Measurement",{"href":133,"dataGaLocation":25,"dataGaName":139},"Visibility and Measurement",{"text":141,"config":142},"Value Stream Management",{"href":143,"dataGaLocation":25,"dataGaName":141},"/solutions/value-stream-management/",{"text":145,"config":146},"Analytics & Insights",{"href":147,"dataGaLocation":25,"dataGaName":148},"/solutions/analytics-and-insights/","Analytics and insights",{"title":150,"type":76,"items":151},"GitLab for",[152,158,164],{"text":153,"config":154},"Enterprise",{"icon":155,"href":156,"dataGaLocation":25,"dataGaName":157},"Building","/enterprise/","enterprise",{"text":159,"config":160},"Small Business",{"icon":161,"href":162,"dataGaLocation":25,"dataGaName":163},"Work","/small-business/","small business",{"text":165,"config":166},"Public Sector",{"icon":167,"href":168,"dataGaLocation":25,"dataGaName":169},"Organization","/solutions/public-sector/","public sector",{"text":171,"config":172},"Pricing",{"href":173,"dataGaName":174,"dataGaLocation":25,"dataNavLevelOne":174},"/pricing/","pricing",{"text":176,"config":177,"menu":179},"Resources",{"dataNavLevelOne":178},"resources",{"type":76,"link":180,"columns":184,"feature":278},{"text":181,"config":182},"View all resources",{"href":183,"dataGaName":178,"dataGaLocation":25},"/resources/",[185,218,245],{"title":186,"items":187},"Getting started",[188,193,198,203,208,213],{"text":189,"config":190},"Install",{"href":191,"dataGaName":192,"dataGaLocation":25},"/install/","install",{"text":194,"config":195},"Quick start guides",{"href":196,"dataGaName":197,"dataGaLocation":25},"/get-started/","quick setup checklists",{"text":199,"config":200},"Learn",{"href":201,"dataGaLocation":25,"dataGaName":202},"https://university.gitlab.com/","learn",{"text":204,"config":205},"Product documentation",{"href":206,"dataGaName":207,"dataGaLocation":25},"https://docs.gitlab.com/","product documentation",{"text":209,"config":210},"Best practice videos",{"href":211,"dataGaName":212,"dataGaLocation":25},"/getting-started-videos/","best practice videos",{"text":214,"config":215},"Integrations",{"href":216,"dataGaName":217,"dataGaLocation":25},"/integrations/","integrations",{"title":219,"items":220},"Discover",[221,226,231,236,240],{"text":222,"config":223},"Customer success stories",{"href":224,"dataGaName":225,"dataGaLocation":25},"/customers/","customer success stories",{"text":227,"config":228},"Blog",{"href":229,"dataGaName":230,"dataGaLocation":25},"/blog/","blog",{"text":232,"config":233},"Demo Hub",{"href":234,"dataGaName":235,"dataGaLocation":25},"/demo-hub/","demo hub",{"text":237,"config":238},"The Source",{"href":239,"dataGaName":230,"dataGaLocation":25},"/the-source/",{"text":241,"config":242},"Remote",{"href":243,"dataGaName":244,"dataGaLocation":25},"https://handbook.gitlab.com/handbook/company/culture/all-remote/","remote",{"title":246,"items":247},"Connect",[248,253,258,263,268,273],{"text":249,"config":250},"GitLab Services",{"href":251,"dataGaName":252,"dataGaLocation":25},"/services/","services",{"text":254,"config":255},"Contribute",{"href":256,"dataGaName":257,"dataGaLocation":25},"https://contributors.gitlab.com","contribute",{"text":259,"config":260},"Community",{"href":261,"dataGaName":262,"dataGaLocation":25},"/community/","community",{"text":264,"config":265},"Forum",{"href":266,"dataGaName":267,"dataGaLocation":25},"https://forum.gitlab.com/","forum",{"text":269,"config":270},"Events",{"href":271,"dataGaName":272,"dataGaLocation":25},"/events/","events",{"text":274,"config":275},"Partners",{"href":276,"dataGaName":277,"dataGaLocation":25},"/partners/","partners",{"config":279,"title":282,"text":283,"link":284},{"background":280,"textColor":281},"url('https://res.cloudinary.com/about-gitlab-com/image/upload/v1777322348/qpq8yrgn8knii57omj0c.png')","#000","What’s new in GitLab","Stay updated with our latest features and improvements.",{"text":285,"config":286},"Read the latest",{"href":287,"dataGaName":288,"dataGaLocation":25},"/whats-new/","whats new",{"text":290,"config":291,"menu":293},"Company",{"dataNavLevelOne":292},"company",{"type":76,"columns":294},[295],{"items":296},[297,302,308,310,315,320,325,330,335,340],{"text":298,"config":299},"About",{"href":300,"dataGaName":301,"dataGaLocation":25},"/company/","about",{"text":303,"config":304,"footerGa":307},"Jobs",{"href":305,"dataGaName":306,"dataGaLocation":25},"/jobs/","jobs",{"dataGaName":306},{"text":269,"config":309},{"href":271,"dataGaName":272,"dataGaLocation":25},{"text":311,"config":312},"Leadership",{"href":313,"dataGaName":314,"dataGaLocation":25},"/company/team/e-group/","leadership",{"text":316,"config":317},"Handbook",{"href":318,"dataGaName":319,"dataGaLocation":25},"https://handbook.gitlab.com/","handbook",{"text":321,"config":322},"Investor relations",{"href":323,"dataGaName":324,"dataGaLocation":25},"https://ir.gitlab.com/overview/default.aspx","investor relations",{"text":326,"config":327},"Trust Center",{"href":328,"dataGaName":329,"dataGaLocation":25},"/security/","trust center",{"text":331,"config":332},"AI Transparency Center",{"href":333,"dataGaName":334,"dataGaLocation":25},"/ai-transparency-center/","ai transparency center",{"text":336,"config":337},"Newsletter",{"href":338,"dataGaName":339,"dataGaLocation":25},"/company/contact/#contact-forms","newsletter",{"text":341,"config":342},"Press",{"href":343,"dataGaName":344,"dataGaLocation":25},"/press/","press",{"text":346,"config":347,"menu":348},"Contact us",{"dataNavLevelOne":292},{"type":76,"columns":349},[350],{"items":351},[352,357,362],{"text":353,"config":354},"Talk to sales",{"href":355,"dataGaName":356,"dataGaLocation":25},"/sales/","talk to sales",{"text":358,"config":359},"Support portal",{"href":360,"dataGaName":361,"dataGaLocation":25},"https://support.gitlab.com/hc/en-us","support portal",{"text":363,"config":364},"Customer portal",{"href":365,"dataGaName":366,"dataGaLocation":25},"https://customers.gitlab.com/customers/sign_in/","customer portal",{"close":368,"login":369,"suggestions":376},"Close",{"text":370,"link":371},"To search repositories and projects, login to",{"text":372,"config":373},"gitlab.com",{"href":39,"dataGaName":374,"dataGaLocation":375},"search login","search",{"text":377,"default":378},"Suggestions",[379,381,385,387,391,395],{"text":56,"config":380},{"href":61,"dataGaName":56,"dataGaLocation":375},{"text":382,"config":383},"Code Suggestions (AI)",{"href":384,"dataGaName":382,"dataGaLocation":375},"/solutions/code-suggestions/",{"text":92,"config":386},{"href":94,"dataGaName":92,"dataGaLocation":375},{"text":388,"config":389},"GitLab on AWS",{"href":390,"dataGaName":388,"dataGaLocation":375},"/partners/technology-partners/aws/",{"text":392,"config":393},"GitLab on Google Cloud",{"href":394,"dataGaName":392,"dataGaLocation":375},"/partners/technology-partners/google-cloud-platform/",{"text":396,"config":397},"Why GitLab?",{"href":69,"dataGaName":396,"dataGaLocation":375},{"freeTrial":399,"mobileIcon":404,"desktopIcon":409,"secondaryButton":412},{"text":400,"config":401},"Start free trial",{"href":402,"dataGaName":30,"dataGaLocation":403},"https://gitlab.com/-/trials/new/","nav",{"altText":405,"config":406},"Gitlab Icon",{"src":407,"dataGaName":408,"dataGaLocation":403},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203874/jypbw1jx72aexsoohd7x.svg","gitlab icon",{"altText":405,"config":410},{"src":411,"dataGaName":408,"dataGaLocation":403},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1758203875/gs4c8p8opsgvflgkswz9.svg",{"text":413,"config":414},"Get Started",{"href":415,"dataGaName":416,"dataGaLocation":403},"https://gitlab.com/-/trial_registrations/new?glm_source=about.gitlab.com/get-started/","get started",{"freeTrial":418,"mobileIcon":422,"desktopIcon":424},{"text":419,"config":420},"Learn more about GitLab Duo",{"href":61,"dataGaName":421,"dataGaLocation":403},"gitlab duo",{"altText":405,"config":423},{"src":407,"dataGaName":408,"dataGaLocation":403},{"altText":405,"config":425},{"src":411,"dataGaName":408,"dataGaLocation":403},{"button":427,"mobileIcon":432,"desktopIcon":434},{"text":428,"config":429},"/switch",{"href":430,"dataGaName":431,"dataGaLocation":403},"#contact","switch",{"altText":405,"config":433},{"src":407,"dataGaName":408,"dataGaLocation":403},{"altText":405,"config":435},{"src":436,"dataGaName":408,"dataGaLocation":403},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1773335277/ohhpiuoxoldryzrnhfrh.png",{"freeTrial":438,"mobileIcon":443,"desktopIcon":445},{"text":439,"config":440},"Back to pricing",{"href":173,"dataGaName":441,"dataGaLocation":403,"icon":442},"back to pricing","GoBack",{"altText":405,"config":444},{"src":407,"dataGaName":408,"dataGaLocation":403},{"altText":405,"config":446},{"src":411,"dataGaName":408,"dataGaLocation":403},{"title":448,"titleMobile":449,"button":450,"config":455},"Duo Agent Platform delivers 400% ROI, per new Forrester Consulting study.","400% ROI: Forrester TEI for GitLab Duo",{"text":67,"config":451},{"href":452,"dataGaName":453,"dataGaLocation":454},"https://about.gitlab.com/blog/gitlab-duo-agent-platform-delivers-400-percent-roi/","forrester-tei-dap-banner","global-banner",{"layout":456,"disabled":10},"release",{"data":458},{"text":459,"source":460,"edit":466,"contribute":471,"config":476,"items":481,"minimal":691},"Git is a trademark of Software Freedom Conservancy and our use of 'GitLab' is under license",{"text":461,"config":462},"View page source",{"href":463,"dataGaName":464,"dataGaLocation":465},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/","page source","footer",{"text":467,"config":468},"Edit this page",{"href":469,"dataGaName":470,"dataGaLocation":465},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/content/","web ide",{"text":472,"config":473},"Please contribute",{"href":474,"dataGaName":475,"dataGaLocation":465},"https://gitlab.com/gitlab-com/marketing/digital-experience/about-gitlab-com/-/blob/main/CONTRIBUTING.md/","please contribute",{"twitter":477,"facebook":478,"youtube":479,"linkedin":480},"https://twitter.com/gitlab","https://www.facebook.com/gitlab","https://www.youtube.com/channel/UCnMGQ8QHMAnVIsI3xJrihhg","https://www.linkedin.com/company/gitlab-com",[482,529,583,627,659],{"title":171,"links":483,"subMenu":498},[484,488,493],{"text":485,"config":486},"View plans",{"href":173,"dataGaName":487,"dataGaLocation":465},"view plans",{"text":489,"config":490},"Why Premium?",{"href":491,"dataGaName":492,"dataGaLocation":465},"/pricing/premium/","why premium",{"text":494,"config":495},"Why Ultimate?",{"href":496,"dataGaName":497,"dataGaLocation":465},"/pricing/ultimate/","why ultimate",[499],{"title":500,"links":501},"Contact Us",[502,505,507,509,514,519,524],{"text":503,"config":504},"Contact sales",{"href":355,"dataGaName":35,"dataGaLocation":465},{"text":358,"config":506},{"href":360,"dataGaName":361,"dataGaLocation":465},{"text":363,"config":508},{"href":365,"dataGaName":366,"dataGaLocation":465},{"text":510,"config":511},"Status",{"href":512,"dataGaName":513,"dataGaLocation":465},"https://status.gitlab.com/","status",{"text":515,"config":516},"Terms of use",{"href":517,"dataGaName":518,"dataGaLocation":465},"/terms/","terms of use",{"text":520,"config":521},"Privacy statement",{"href":522,"dataGaName":523,"dataGaLocation":465},"/privacy/","privacy statement",{"text":525,"config":526},"Cookie preferences",{"dataGaName":527,"dataGaLocation":465,"id":528,"isOneTrustButton":14},"cookie preferences","ot-sdk-btn",{"title":72,"links":530,"subMenu":539},[531,535],{"text":532,"config":533},"DevSecOps platform",{"href":54,"dataGaName":534,"dataGaLocation":465},"devsecops platform",{"text":536,"config":537},"AI-Assisted Development",{"href":61,"dataGaName":538,"dataGaLocation":465},"ai-assisted development",[540],{"title":541,"links":542},"Topics",[543,548,553,558,563,568,573,578],{"text":544,"config":545},"CICD",{"href":546,"dataGaName":547,"dataGaLocation":465},"/topics/ci-cd/","cicd",{"text":549,"config":550},"GitOps",{"href":551,"dataGaName":552,"dataGaLocation":465},"/topics/gitops/","gitops",{"text":554,"config":555},"DevOps",{"href":556,"dataGaName":557,"dataGaLocation":465},"/topics/devops/","devops",{"text":559,"config":560},"Version Control",{"href":561,"dataGaName":562,"dataGaLocation":465},"/topics/version-control/","version control",{"text":564,"config":565},"DevSecOps",{"href":566,"dataGaName":567,"dataGaLocation":465},"/topics/devsecops/","devsecops",{"text":569,"config":570},"Cloud Native",{"href":571,"dataGaName":572,"dataGaLocation":465},"/topics/cloud-native/","cloud native",{"text":574,"config":575},"AI for Coding",{"href":576,"dataGaName":577,"dataGaLocation":465},"/topics/devops/ai-for-coding/","ai for coding",{"text":579,"config":580},"Agentic AI",{"href":581,"dataGaName":582,"dataGaLocation":465},"/topics/agentic-ai/","agentic ai",{"title":584,"links":585},"Solutions",[586,588,590,595,599,602,606,609,611,614,617,622],{"text":115,"config":587},{"href":110,"dataGaName":115,"dataGaLocation":465},{"text":105,"config":589},{"href":88,"dataGaName":89,"dataGaLocation":465},{"text":591,"config":592},"Agile development",{"href":593,"dataGaName":594,"dataGaLocation":465},"/solutions/agile-delivery/","agile delivery",{"text":596,"config":597},"SCM",{"href":101,"dataGaName":598,"dataGaLocation":465},"source code management",{"text":544,"config":600},{"href":94,"dataGaName":601,"dataGaLocation":465},"continuous integration & delivery",{"text":603,"config":604},"Value stream management",{"href":143,"dataGaName":605,"dataGaLocation":465},"value stream management",{"text":549,"config":607},{"href":608,"dataGaName":552,"dataGaLocation":465},"/solutions/gitops/",{"text":153,"config":610},{"href":156,"dataGaName":157,"dataGaLocation":465},{"text":612,"config":613},"Small business",{"href":162,"dataGaName":163,"dataGaLocation":465},{"text":615,"config":616},"Public sector",{"href":168,"dataGaName":169,"dataGaLocation":465},{"text":618,"config":619},"Education",{"href":620,"dataGaName":621,"dataGaLocation":465},"/solutions/education/","education",{"text":623,"config":624},"Financial services",{"href":625,"dataGaName":626,"dataGaLocation":465},"/solutions/finance/","financial services",{"title":176,"links":628},[629,631,633,635,638,640,643,645,647,649,651,653,655,657],{"text":189,"config":630},{"href":191,"dataGaName":192,"dataGaLocation":465},{"text":194,"config":632},{"href":196,"dataGaName":197,"dataGaLocation":465},{"text":199,"config":634},{"href":201,"dataGaName":202,"dataGaLocation":465},{"text":204,"config":636},{"href":206,"dataGaName":637,"dataGaLocation":465},"docs",{"text":227,"config":639},{"href":229,"dataGaName":230,"dataGaLocation":465},{"text":641,"config":642},"What's new",{"href":287,"dataGaName":288,"dataGaLocation":465},{"text":222,"config":644},{"href":224,"dataGaName":225,"dataGaLocation":465},{"text":241,"config":646},{"href":243,"dataGaName":244,"dataGaLocation":465},{"text":249,"config":648},{"href":251,"dataGaName":252,"dataGaLocation":465},{"text":254,"config":650},{"href":256,"dataGaName":257,"dataGaLocation":465},{"text":259,"config":652},{"href":261,"dataGaName":262,"dataGaLocation":465},{"text":264,"config":654},{"href":266,"dataGaName":267,"dataGaLocation":465},{"text":269,"config":656},{"href":271,"dataGaName":272,"dataGaLocation":465},{"text":274,"config":658},{"href":276,"dataGaName":277,"dataGaLocation":465},{"title":290,"links":660},[661,663,665,667,669,671,675,680,682,684,686],{"text":298,"config":662},{"href":300,"dataGaName":292,"dataGaLocation":465},{"text":303,"config":664},{"href":305,"dataGaName":306,"dataGaLocation":465},{"text":311,"config":666},{"href":313,"dataGaName":314,"dataGaLocation":465},{"text":316,"config":668},{"href":318,"dataGaName":319,"dataGaLocation":465},{"text":321,"config":670},{"href":323,"dataGaName":324,"dataGaLocation":465},{"text":672,"config":673},"Sustainability",{"href":674,"dataGaName":672,"dataGaLocation":465},"/sustainability/",{"text":676,"config":677},"Diversity, inclusion and belonging (DIB)",{"href":678,"dataGaName":679,"dataGaLocation":465},"/diversity-inclusion-belonging/","Diversity, inclusion and belonging",{"text":326,"config":681},{"href":328,"dataGaName":329,"dataGaLocation":465},{"text":336,"config":683},{"href":338,"dataGaName":339,"dataGaLocation":465},{"text":341,"config":685},{"href":343,"dataGaName":344,"dataGaLocation":465},{"text":687,"config":688},"Modern Slavery Transparency Statement",{"href":689,"dataGaName":690,"dataGaLocation":465},"https://handbook.gitlab.com/handbook/legal/modern-slavery-act-transparency-statement/","modern slavery transparency statement",{"items":692},[693,696,699],{"text":694,"config":695},"Terms",{"href":517,"dataGaName":518,"dataGaLocation":465},{"text":697,"config":698},"Cookies",{"dataGaName":527,"dataGaLocation":465,"id":528,"isOneTrustButton":14},{"text":700,"config":701},"Privacy",{"href":522,"dataGaName":523,"dataGaLocation":465},252,{"id":704,"title":705,"authors":706,"body":708,"category":9,"date":813,"description":814,"extension":815,"externalUrl":6,"faq":6,"featured":10,"heroImage":816,"meta":817,"navigation":14,"path":818,"seo":819,"slug":821,"stem":822,"tags":823,"template":826,"updatedDate":6,"__hash__":827},"blogPosts/en-us/blog/improved-scope-offset-fingerprinting.md","How GitLab tracks vulnerabilities through refactors and reformatting",[707],"Julian Thome",{"type":709,"value":710,"toc":809},"minimark",[711,715,742,750,753,756,762,773,788],[712,713,714],"p",{},"Every day, security scans face the same problem: an agent or a developer adds a comment, reformats a file, or moves a function, and a naive vulnerability tracker suddenly reports the same finding twice. Security teams end up re-triaging issues they already dismissed, which causes futile auditing effort and erodes trust in the scan results.",[712,716,717,718,724,725,729,730,733,734,737,738,741],{},"In 2022, we ",[719,720,723],"a",{"href":721,"rel":722},"https://about.gitlab.com/blog/introducing-gitlab-advanced-vulnerability-tracking/",[],"introduced advanced vulnerability tracking"," to tackle exactly this problem of ",[726,727,728],"em",{},"code volatility",". It is based on our ",[726,731,732],{},"Scope+Offset"," fingerprinting method: instead of identifying a finding by file and line number, we identify it by its narrowest enclosing ",[726,735,736],{},"scope"," (module, class, function) plus its line ",[726,739,740],{},"offset"," within that scope. That made tracking robust against code moving around the file and reduced futile re-auditing by about 30% compared to line-based tracking.",[712,743,744,745,749],{},"But one class of edits still slipped through: ",[746,747,748],"strong",{},"non-functional changes",". The offset counted every line between the scope boundary and the finding, including comments and blank lines. Add a comment above a vulnerable statement, and the offset shifts. The tracker sees a \"new\" vulnerability; you see a duplicate.",[712,751,752],{},"Our improved method addresses this by simply ignoring non-functional code (comments and blank lines) when computing the fingerprint. Since these lines do not affect the program's behavior, they should not affect the identity of a vulnerability either. With this normalization in place, adding a comment or reformatting a file no longer changes the fingerprint, while the precision of the tracking remains the same as before. The details of the approach are described in our accompanying research paper.",[712,754,755],{},"We evaluated the normalized method on a targeted benchmark: 439 source files across C/C++, C#, Go, Java, JavaScript, Python, and Ruby. We generated 2,247 commits, each inserting a single comment or blank line directly before a known vulnerability, and scanned the code as the history was replayed. The benchmark deliberately stresses the worst case: every commit is a non-functional edit right next to a finding.",[712,757,758,759,761],{},"On this benchmark, the original ",[726,760,732],{}," method accumulated 1,361 duplicate fingerprints, a 77% growth over the baseline. The normalized method produced zero duplicates and reduced unique fingerprints by 43% overall.",[712,763,764,767,768,772],{},[726,765,766],{},"Normalized Scope+Offset"," ships in GitLab as the ",[769,770,771],"code",{},"scope_offset_compressed"," tracking algorithm, supporting C#, C/C++, Go, Java, JavaScript, Python, Ruby, and PHP. It reuses the parse tree the scanner already constructs, so scan times are unaffected. The security report format is unchanged, so it composes with any combination of SAST tools in a heterogeneous setup.",[712,774,775,776,781,782,787],{},"The preprint of our study \"",[719,777,780],{"href":778,"rel":779},"https://res.cloudinary.com/about-gitlab-com/image/upload/v1786457681/jm8oieyjhwut8ed2cpaq.pdf",[],"Vulnerability Tracking using Normalized\nScope+Offset","\" by Julian Thome, Hua Yan, Lucas Charles,\nCraig Smith, and Jason Leasure will be presented at the ",[719,783,786],{"href":784,"rel":785},"https://conf.researchr.org/track/ase-2026/ase-2026-industry-showcase",[],"ASE 2026 Industry Showcase",".",[712,789,790],{},[726,791,792,797,798,797,803,808],{},[719,793,796],{"href":794,"rel":795},"https://gitlab.com/hyan3",[],"Hua Yan",", ",[719,799,802],{"href":800,"rel":801},"https://gitlab.com/theoretick",[],"Lucas Charles",[719,804,807],{"href":805,"rel":806},"https://gitlab.com/craigmsmith",[],"Craig Smith",", and Jason Leasure contributed to this article and study.",{"title":810,"searchDepth":811,"depth":811,"links":812},"",2,[],"2026-08-12","Learn how GitLab's improved Scope+Offset fingerprinting keeps vulnerability tracking stable across comments, blank lines, and reformatting.","md","https://res.cloudinary.com/about-gitlab-com/image/upload/v1759320418/xjmqcozxzt4frx0hori3.png",{},"/en-us/blog/improved-scope-offset-fingerprinting",{"config":820,"title":705,"description":814},{"noIndex":10},"improved-scope-offset-fingerprinting","en-us/blog/improved-scope-offset-fingerprinting",[9,824,825,532],"security research","features","BlogPost","z9PxFKU9o9EEdo574q4RbWeXmDMzxOe1JTqEG3gukKs",[829,837,842,846,853,861,869,873,880],{"title":830,"heroImage":831,"category":9,"description":832,"authors":833,"slug":836,"externalUrl":6},"GitLab Advanced SAST is now generally available","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749665917/Blog/Hero%20Images/blog-advanced-sast-creative-imagery-0390-1800x945-fy25.png","Reduce false positives, shorten remediation time, and improve development velocity with a proprietary solution built into GitLab.",[834,835],"Salman Ladha","Connor Gilbert","gitlab-advanced-sast-is-now-generally-available",{"title":838,"heroImage":839,"category":9,"description":840,"authors":6,"slug":6,"externalUrl":841},"GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749662877/Blog/Hero%20Images/security-cover-new.png","Learn more about GitLab Critical Patch Release: 17.3.3, 17.2.7, 17.1.8, 17.0.8, 16.11.10 for GitLab Community Edition (CE) and Enterprise Edition (EE).","https://docs.gitlab.com/releases/patches/patch-release-gitlab-17-3-3-released/",{"title":843,"heroImage":839,"category":9,"description":844,"authors":6,"slug":6,"externalUrl":845},"GitLab Critical Patch Release: 17.3.2, 17.2.5, 17.1.7","Learn more about GitLab Critical Patch Release: 17.3.2, 17.2.5, 17.1.7 for GitLab Community Edition (CE) and Enterprise Edition (EE).","https://docs.gitlab.com/releases/patches/patch-release-gitlab-17-3-2-released/",{"title":847,"heroImage":848,"category":9,"description":849,"authors":850,"slug":852,"externalUrl":6},"Secure open source container infrastructure with GitLab and Chainguard","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098693/Blog/Hero%20Images/Blog/Hero%20Images/blog-image-template-1800x945%20%2823%29_2w6waL76KROjhJHM2vXet6_1750098693265.png","Learn how GitLab + Chainguard can help deliver secure containerized applications faster. This tutorial includes easy-to-follow code examples.",[851],"Fernando Diaz","secure-open-source-container-infrastructure-with-gitlab-and-chainguard",{"title":854,"heroImage":855,"category":9,"description":856,"authors":857,"slug":860,"externalUrl":6},"Annotate container images with build provenance using Cosign in GitLab CI/CD","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750098395/Blog/Hero%20Images/Blog/Hero%20Images/blog-image-template-1800x945%20%2823%29_2w6waL76KROjhJHM2vXet6_1750098395162.png","Use GitLab pipelines to automate building, signing, and annotating Docker images. This tutorial shares code to show you how. Try it out in your own organization.",[858,859],"João Pereira","Tim Rizzi","annotate-container-images-with-build-provenance-using-cosign-in-gitlab-ci-cd",{"title":862,"heroImage":863,"category":9,"description":864,"authors":865,"slug":868,"externalUrl":6},"How to choose the right security scanning approach","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750097969/Blog/Hero%20Images/Blog/Hero%20Images/AdobeStock_282096522_securitycompliance.jpeg_1750097968823.jpg","GitLab offers multiple scanning methods for CI/CD pipelines, including compliance frameworks and scan and pipeline execution policies. Learn the basics, configurations, and advantages/disadvantages.",[866,867],"Matt Genelin","Mathias Ewald","how-to-choose-the-right-security-scanning-approach",{"title":870,"heroImage":839,"category":9,"description":871,"authors":6,"slug":6,"externalUrl":872},"GitLab Patch Release: 17.3.1, 17.2.4, 17.1.6","Learn more about GitLab Patch Release: 17.3.1, 17.2.4, 17.1.6 for GitLab Community Edition (CE) and Enterprise Edition (EE).","https://docs.gitlab.com/releases/patches/patch-release-gitlab-17-3-1-released/",{"title":874,"heroImage":875,"category":9,"description":876,"authors":877,"slug":879,"externalUrl":6},"How GitLab helps meet NIS2 requirements","https://res.cloudinary.com/about-gitlab-com/image/upload/v1749659437/Blog/Hero%20Images/AdobeStock_398929148.jpg","The EU's NIS2 cybersecurity legislation focuses on resilience, incident response, and risk management. Learn how GitLab's DevSecOps platform helps meet these compliance requirements.",[878],"Joseph Longo","how-gitlab-helps-meet-nis2-requirements",{"title":881,"heroImage":882,"category":9,"description":883,"authors":884,"slug":887,"externalUrl":6},"FinServ: How to implement GitLab's separation of duties features","https://res.cloudinary.com/about-gitlab-com/image/upload/v1750097688/Blog/Hero%20Images/Blog/Hero%20Images/blog-image-template-1800x945%20%286%29_6vL96ttKF8zJLLqfPpvFs_1750097687913.png","Learn how GitLab ensures secure, compliant software development with separation of duties in the financial services sector, including features that help adhere to regulatory frameworks.",[885,886],"Cherry Han","Gavin Peltz","finserv-how-to-implement-gitlabs-separation-of-duties-features",1786803780490]