## Problem statement Static Analysis is trying to create like-for-like replacements for many of our existing analyzers. We’re trying to do so in such a way that we achieve the following objectives: 1. Don’t duplicate findings when two analyzers in a pipeline find the same thing — https://gitlab.com/gitlab-org/gitlab/-/issues/321293 1. Don’t re-report vulnerabilities that have been dismissed or resolved when the original analyzer is removed from the product. The latter capability ha been defined as a requirement for SAST analyzers to be retired. We are currently keeping analyzers around (i.e. bandit, eslint) even though there is a replacement for them already in place (semgrep). Making such a change at this time would cause existing vulnerabilities to be duplicated, even if customers have marked findings as false positives or resolved. See https://gitlab.com/gitlab-org/gitlab/-/issues/299589 for background on much of the exploratory work ## Open questions - Beyond the JSON schema, is there documentation enumerating hard requirements or constraints about the reports it processes? ## Implementation plan