## Defect Clustering

**Goal**: Identify relationships among surviving defects, mark independent but related defects as clusters to indicate systemic risk.

**Difference from deduplication**: Deduplication merges defects with the same root cause into a single report; clustering marks related but independent defects without merging reports.

### Clustering Patterns

#### Multiple Defects in the Same Function

Two or more independent defects exist within the same function:

| Clustering Signal | Determination |
|---------|------|
| The same function name appears 2+ times in the location descriptions of different defects | Mark as cluster: "[Function name] has multiple defects, recommend holistic review" |

#### Multiple Defects in the Same File

Three or more defects exist within the same file:

| Clustering Signal | Determination |
|---------|------|
| The same file path appears 3+ times across different defects | Mark as cluster: "[File name] has systemic issues" |
| Defects in the same file cover multiple different functions | Mark as cluster: "[File name] has defects in multiple locations, recommend refactoring" |

#### Multiple Security Defects on the Same API

Multiple security-type defects exist on the same API endpoint:

| Clustering Signal | Determination |
|---------|------|
| The same API path/function name has 2+ security-type defects (injection/XSS/authentication/authorization) | Mark as cluster: "[API name] needs security hardening" |

#### Same Data Flow Path

Multiple defect descriptions involve the same data flow path:

| Clustering Signal | Determination |
|---------|------|
| Multiple defect descriptions mention the same input source → processing → output chain | Mark as cluster: "[Path name] has systemic risk" |

#### Multiple Defects in the Same Component/Module

Multiple defects exist in the same component or module:

| Clustering Signal | Determination |
|---------|------|
| 3+ defects under the same package/module/directory | Mark as cluster: "[Component name] quality is concerning, recommend systematic investigation" |

### Clustering Rules

- **Based on location information in defect reports**: file paths, function names, API paths, module names
- **Do not modify defect report content**: clustering information is presented as additional annotations in the report summary section
- **A defect can belong to multiple clusters**: e.g., the same function has both security defects and logic defects
- **Only execute when surviving defects >= 2**: no need for clustering with a single defect
