What the data for this category looks like
This category of data comes from private vulnerability reports, code repositories, CVE numbering authorities, and official release channels. Daily documents include security advisories, vulnerability reports, fix patches, and CVE application materials. Data updates follow the rhythm of single vulnerability events. Each document contains fixed fields such as vulnerability ID, impact scope, fix solution, and disclosure time. Updates are only triggered when new vulnerabilities are discovered or fix actions are taken.
What constraints do these characteristics impose on the "source citation and traceability" link?
Data in this category has both private and public attributes. Private vulnerability reports may only be viewed by authorized internal personnel. Public documents must strictly follow disclosure procedures. The single-event-driven update rhythm requires the traceability link to accurately bind documents related to a single vulnerability, to avoid confusion across events. The fixed field structure requires precise matching of core information such as vulnerability ID and fix status when citing, and fuzzy matching cannot be relied on. Compliance requirements limit the visibility scope of cited content to prevent unauthorized disclosure of content.
How to Configure
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | FastGPT v4.17.0 natively supports this range for context limits. Documents in this category are mostly structured vulnerability information, so this range can fully cover core content |
| Visibility Control | Differentiate by document source: private reports are only accessible to internal roles, public documents are accessible to all users | Data in this category has both private and public attributes, and must comply with compliance disclosure requirements |
responseData | Only return reviewed and approved cited content | Filter vulnerability information that has not completed the disclosure process to avoid premature disclosure of non-public content |
| Citation Count Limit | Top 3–5 entries | The number of documents associated with a single vulnerability event is limited. Too many citations will interfere with core information delivery |
detail | 500–1000 characters | Some CVE application materials in this category contain long-form technical details. This range can cover core technical descriptions |
Three Common Configuration Mistakes
- Symptom: Cited content from some vulnerability reports cannot be viewed by designated roles, while some roles can directly view the original text. Cause: Visibility control rules are not configured based on document source, and permission settings for private and public documents are confused.
- Symptom: Knowledge base retrieval only returns citations from a single document, and cannot associate multiple patches and advisories from the same event. Cause: Document grouping rules based on vulnerability ID are not configured, and retrieval is only performed per single document.
- Symptom: Cited content includes undisclosed vulnerability details, triggering compliance risks. Cause: The
responseDatareview filter configuration is not enabled, and document content that has not completed the process is returned directly.
How to Verify Proper Configuration
- Upload a private vulnerability report, switch to an unauthorized role, and verify that the cited original text cannot be viewed.
- Upload a security advisory and fix patch for the same vulnerability event, and verify that multiple documents can be associated simultaneously during retrieval.
- Adjust
quoteMaxTokento 600 tokens, and check whether the truncation of cited content meets expectations. - Submit a test request, and verify that the returned cited content only includes document information that has completed the disclosure process.
The values provided are common starting points and should be measured against the reader’s own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.