What this category of data looks like
Data for this category primarily comes from source code repositories, dependency manifests, static application security testing (SAST) tools, and public vulnerability databases. Update cadence follows project versions or iteration cycles. Daily output documents include code audit reports, vulnerability proofs, repair suggestions, and retest records. Each document’s fields include vulnerability IDs, impact scope, code line numbers, repaired code snippets, and risk levels. There are no fixed unified units; archiving is performed per project dimension.
What constraints these characteristics impose on the citation sources and traceability link
Data sources are scattered and updated with versions. Traceability operations must associate code repository snapshots and dependency version lists corresponding to the relevant version, to avoid information misalignment caused by cross-version citations. Document structures vary. Different citation rules must be matched for different document types, to prevent confusion between different fields in audit reports, vulnerability proofs, and retest records. Update frequency is high. Cited traceability information must match the current audit version to avoid outdated data. Additionally, traceability for high-risk vulnerabilities must cover the complete attack path, which imposes higher requirements on context length and recall scope.
How to set configurations
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the average length of code audit reports and vulnerability proofs, ensures complete citation of key code snippets and risk descriptions, and adapts to the context processing logic of FastGPT v4.17.0 |
responseData | Include citation source fields | Requires returned results to carry the source path, version number, and line number of the corresponding document, while supporting embedding cited knowledge base content into the response body to meet traceability and display requirements |
detail | Enable full details | Covers all information for data flow tracking and repair plan review, avoiding omission of details from key audit nodes |
| Maximum context length | 16000 token | Adapts to the total length after splicing multi-source data, preventing truncation of important audit process descriptions |
| Single recall limit | Top 10 entries | Covers common multi-vulnerability scenarios, while avoiding excessive redundant information interfering with reviews |
Three common misconfigurations
- When a request is sent, the interface connects but no content is returned. The cause is that the
responseDataparameter is not correctly configured, and the required citation source and body content fields are not specified, resulting in an empty response body. - The content of the cited audit document has messy formatting. The cause is that a reasonable range for
quoteMaxTokenis not set, causing long code snippets to be truncated or spliced incorrectly, which damages the original text formatting structure. - Garbled characters appear in traceability results. The cause is that the encoding format of the corresponding code repository is not matched, and the correct character set parameter is not specified in the citation configuration, resulting in encoding errors when reading source code.
How to confirm configuration is correct
- A test request is sent, and the returned results are checked for the presence of the
responseDatafield, which contains traceability information such as source code repository path and vulnerability ID. - The returned cited content is reviewed, and it is confirmed that the code snippets are not excessively truncated and conform to the length range set by
quoteMaxToken. - A test code snippet containing non-ASCII characters is submitted, and the returned results are verified to have no garbled characters, confirming that the character set configuration is effective.
- The version number of the current audit project is compared, and it is checked that the cited traceability information matches the code repository snapshot of the current version.
The values provided here are common starting points and should be validated against local project samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.