Verification · Finding validation · Finding deduplication
Fingerprinting across runs
Stable fingerprints so a finding is recognised on the next commit.
How to build it
- Compute a fingerprint from the rule ID, file path and normalised code, not the line number.
- Store the fingerprint on each finding in the output.
- Match new findings to the previous run's fingerprints before reporting them.
Signals in a repository
- SARIF results that carry a partialFingerprints object.
- A findings table or file keyed by fingerprint.
- Normalisation code that strips whitespace before hashing.
In practice
No scanned repository runs a tool for this check. The steps above are the only guidance.