What the data for this category looks like
The data for this category mainly comes from target systems, public vulnerability databases, automated scanner results, and manual verification records from red team engineers. Data updates follow the cycle of individual projects or major system versions, with no fixed universal update rhythm. Daily associated documents include test authorization letters, penetration test reports, vulnerability reproduction records, and remediation suggestions. Each document contains fixed fields such as authorization scope, vulnerability ID, risk level, reproduction steps, and repair solutions. Some manual verification records will add temporary fields as testing progresses.
What constraints these characteristics impose on the "multi-turn dialogue and prompts" link
The data sources for this category are scattered and require manual verification. Multi-turn dialogue must support associating temporary and official documents from different sources. Prompts must clearly distinguish between scan results and manual verification conclusions. Data is updated per project, so dialogue context must be bound to chatId to isolate session data from different projects and avoid cross-project information confusion. Documents contain legally related authorization letter content, so prompts must filter sensitive authorization details and only display information within the compliant scope to customers. There are large differences in fields across individual documents, so variables must be configured to match the field names of different documents to reduce prompt adjustment costs.
How to set the configurations
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Question Optimization | Enabled, called before each dialogue | Penetration testing questions often contain technical terms and vulnerability IDs; optimizing prompts improves the accuracy of context understanding |
| Maximum Context | First 8 rounds of messages | Single-project sessions typically do not exceed 10 rounds; retaining the first 8 rounds balances information completeness and response speed |
chatId Binding | Bound by project ID | Prevents confusion of session data across different penetration testing projects, aligns with the project-based data update characteristic |
variables Matching | Preset variables based on document fields | Adapts to fixed fields in penetration test reports and authorization letters, reduces manual prompt adjustments |
| Session Context Retention Duration | 30 days | Aligns with the average project cycle; automatically cleans up after expiration without manual operation |
| Streaming Output Switch | Enabled | Long vulnerability analysis content can be returned in segments, improving customer waiting experience |
Three common mistakes
- Phenomenon: The workflow terminates immediately after reaching the AI dialogue step, which can be reproduced for specific questions. Cause:
variablesare not correctly bound to match the fields in the penetration test report, causing context call failure and workflow interruption. - Phenomenon: Dialogue logs are not automatically deleted as expected in the local deployment version. Cause: The session context retention duration is configured incorrectly, or the automatic cleanup switch is not enabled.
- Phenomenon: No streaming output is returned after calling the API to initiate a dialogue, and subsequent processing modules cannot be connected in the workflow. Cause: The streaming output configuration item is not enabled, and the return format of the
messagesparameter is not correctly configured.
How to confirm the configuration is complete
- Use the FastGPT v4.17.0 interface to initiate a test question containing a vulnerability ID and authorization scope, and check whether the dialogue context only displays information within the compliant scope.
- Start a test workflow, trigger multiple executions of the same question, and confirm that session data will not be confused across projects.
- Call the API to initiate a dialogue, and check whether segmented streaming content is returned.
- Wait 30 days in the local deployment environment, and confirm that the context data of old sessions has been automatically cleaned up.
The values provided here are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.