“Deduplication” is the process of eliminating duplicate reports. External reports and internal analysis may repeatedly identify the same problem. Apply deduplication to prevent duplication of effort.
In practice, you need to deduplicate repeatedly as you learn new information. Projects may deduplicate before validation (to eliminate obvious duplicates that don’t need duplicate validation), and deduplicate again after validation has gained more information.
Some writers consider deduplication part of triage (e.g., [Yan2026]), and others treat them separately. No matter how you define the terms, all are needed.
[Yan2026] recommends the following for deduplication:
Consider the root cause. “Scanners often flag one bug at multiple call sites or report multiple symptoms of a single root cause. Here’s one practical approach: First, use a cheap deterministic pass: same file, same category, vulnerability line numbers within ten lines of each other. Then, have a model apply qualitative rules to what remains”
“Treat as duplicate: the same root cause worded differently; the same vulnerability reported at multiple call sites; a missing global protection (like an auth check) reported per endpoint; or a cause and its consequence flagged in the same path”
“Treat as distinct: different vulnerability classes in the same file; different variables reaching different sinks; two independent bugs inside one helper; the same missing check on two endpoints, but each requires its own fix”
If you have a PoC and a candidate patch for each finding, “check if the patch for one finding also disarms the PoCs of others”. If it does, it’s likely that those findings share a root cause
If it’s not clear that a finding is a duplicate, pass it along to be validated separately. Once more information is acquired, it may be easier to determine if it’s a duplicate.
Quiz
Q1. According to the guidance in this section, which of the following should most likely be treated as distinct findings rather than duplicates?
The same vulnerability reported at multiple call sites that all trace back to one root cause.
A missing global protection, such as an authentication check, reported separately for each affected endpoint.
A root-cause defect and one of its direct consequences flagged together along the same code path.
The same missing check reported on two different endpoints, where each endpoint requires its own separate fix.
Finding and Fixing Vulnerabilities Using AI