What Data for This Category Looks Like
Data for this category is maintained by project security response teams, maintainers, or security researchers. Sources include private vulnerability reports, code repositories, official channels of CVE numbering bodies, and project release channels. Data is updated per single vulnerability event. Daily documentation formats include security advisories, vulnerability reports, fix patch packages, and CVE application materials. Core fields include unique vulnerability identifiers, impact scope, patch links, disclosure time, and fix descriptions. There is no fixed batch update cycle. Data is generated or updated only when new vulnerabilities are discovered, fixed, or disclosed.
Constraints for Source Citation and Traceability
Single vulnerability event data has a small volume but strong correlation. Traceability must accurately bind all sources associated with the corresponding event to avoid mixing unrelated data. Original content of private vulnerability reports must be encrypted and linked to traceability records to prevent unauthorized access. CVE numbers serve as unique identifiers and must be used as the core association field for traceability. Data formats vary widely across different sources. Unified standardization must be completed before traceability verification can proceed. Additionally, the disclosure time coordination process requires traceability information to include accurate source timestamps to ensure consistency of disclosure schedules.
Configuration Settings
This configuration applies to FastGPT v4.17.0 and later versions.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
quoteMaxToken | 800–1200 token | Matches the average length of single vulnerability-related documents for this category, avoids truncating core traceability information |
responseData | ["cve_id", "vuln_scope", "patch_link", "disclosure_time"] | Covers core fields of data for this category, ensures complete traceability information |
detail | true | Enables return of full source context to meet traceability verification requirements |
| Maximum number of cited sources | Top 5 | Matches the typical number of sources for a single vulnerability event, avoids recalling unrelated data |
| Context window reserve | 200 characters | Reserves space for supplementary auxiliary information for traceability verification |
Three Common Configuration Errors
- Troubleshooting: If an API call returns a red numeric error code, check whether
AIPROXY_API_ENDPOINT(root address of the AI Proxy service, format example: http://aiproxy:3000, no additional path suffix) and non-emptyAIPROXY_API_TOKEN(AI Proxy administrator token, must match the configuration on the AI Proxy server) are configured in the App/Admin server. Missing these configurations will cause service startup verification failure. - Phenomenon: Generated responses do not display any cited source information. Cause: The
detailconfiguration item is not set totrue, and the traceability information return logic is not enabled. - Phenomenon: Traceability results include non-vulnerability-related document content. Cause:
quoteMaxTokenor maximum number of cited sources is not restricted, causing recall of data outside the target scope.
How to Confirm Configuration Is Complete
- Check FastGPT service startup logs to confirm there are no error messages related to AI Proxy startup verification failures.
- Initiate an API Q&A request for the vulnerability disclosure scenario, and check whether the returned results include the fields specified in the
responseDataconfiguration item. - Verify that the returned traceability information corresponds one-to-one with the core data fields of this category.
- Test triggering a traceability verification process after a vulnerability disclosure, confirm that all associated sources are correctly identified.
The values provided are common starting points and should be validated against local sample data.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.