The first party code has been collected, and now based on the paths of the callsites, group vulnerabilities together. "Group by manifest"