The stable finding-identity namespace is fendix/v2. It gives baselines, fingerprint suppressions, diffs, and SARIF consumers a semantic identity that survives presentation changes and line movement.
Identity construction
SHA-256 over NUL-separated labelled components, truncated to 20 bytes and hex encoded.
Every component is labelled. Depending on the finding family, identity uses category and rule plus a normalized code artifact/symbol/operation, a secret file/non-sensitive identifier, a dependency advisory/package/manifest, or a service endpoint identity.
Generated identity examples
alg=fendix/v2
cat=injection
rule=python.sql-injection.taint
file=src/users.py
sym=get_user
op=cursor.execute(query)
52e177542ce259872875842108edc92099f66fdfalg=fendix/v2
cat=secrets
rule=secrets/aws-access-key
file=config/settings.py
ident=AWS_ACCESS_KEY_ID
4a556e471dfc5f23555a1ba02c8b0e9ffc68415balg=fendix/v2
cat=auth
rule=dast/auth
ep=https://staging.example.com/users/42
3dd2812f69d1fff13b4acaf1a00f729413f174b5Stability boundary
The same normalized condition can keep its identity when wording, line number, severity, confidence, or disposition changes. Changing a semantic identity input such as the rule, artifact, symbol, sink operation, package, or service endpoint may produce a new fingerprint.
Deliberately excluded
Findings and occurrences
A finding is a presentation group. Each location of the same check is an occurrence with its own fingerprint in occurrences[].fingerprint, computed from that occurrence alone, before grouping. The finding's fingerprint is its primary occurrence's, which is the location that sorts first, so it names one occurrence and never the group. Baselines, .fendix-ignore and issue lifecycle match occurrences, so a new location never inherits a suppression or disposition from the group it is shown in.
Migration from fendix/v1
fendix/v1 hashed category, endpoint, and title and moved when those presentation/location values changed. Reports may carry fingerprint_v1 as a bridge, but new matching uses fendix/v2. Regenerate pre-v3 baselines and fingerprint ignore rules.