Finding deduplication
Merges findings that describe the same problem from different reviewers, files or runs into one.
Sub-techniques
3
| ID | Name | Description |
|---|---|---|
V1045.001 | Semantic dedup | Cluster findings by embedding similarity and location. |
V1045.002 | Consolidation | Merge a cluster into one finding that keeps all evidence. |
V1045.003 | Fingerprinting across runs | Stable fingerprints so a finding is recognised on the next commit. |
Craft it
- Emit findings as SARIF or a common schema with file, line and rule.
- Fingerprint by rule, file and normalised code, not line number.
- Cluster the remainder by embedding and merge.
Reverse engineer it
Signs that a codebase already runs this technique, and where to read how it is configured.
- SARIF partialFingerprints, or a findings table keyed by fingerprint.
Open-source packages
3
- Sentence Transformers huggingface/sentence-transformers
- FAISS facebookresearch/faiss
- sarif-tools microsoft/sarif-tools