What data looks like for this category
Data is generated across the full penetration testing workflow. Daily documents include test authorization letters, penetration test reports, vulnerability reproduction records, and rectification suggestions. Data sources cover target system assets, public vulnerability databases, automated scanner results, and manual verification records. Updates follow individual test project cycles, or adjust synchronously with major system version or vulnerability database updates. Data fields include test scope, vulnerability ID, reproduction steps, risk rating, rectification deadline, and more. There are no unified fixed units, with adjustments made flexibly based on the specific needs of individual test projects.
What constraints do these characteristics impose on the "source citation and traceability" link
The data characteristics of this category create multiple constraints for the citation and traceability process. Since data sources are scattered across target systems, vulnerability databases, scanner results, and manual verification records, independent traceability identifiers must be configured for content from different sources to avoid confusion between test data types. The project-based update rhythm requires traceability information to bind to the unique identifier of the current test project, ensuring cited content belongs to the corresponding task. Documents include compliance files such as test authorization letters, so traceability must link to compliance basis to avoid legal authorization disputes. Vulnerability reproduction records are strongly tied to final reports, so traceability must retain a complete verification chain to prevent vulnerability omissions or risk rating deviations.
Configuration Settings
| Configuration Item | Recommended Approach | Rationale |
|---|---|---|
quoteMaxToken | 1500–2000 token | Adapt to the need for citing long paragraphs of vulnerability reproduction steps in penetration test reports, avoiding truncation of critical information |
responseData | Enable full fields of associated documents | Cover traceability information for multiple document types including test authorization letters and vulnerability reproduction records, fully retaining source details |
detail | Enable full traceability | Retain original source identifiers for manual verification records and scanner results, distinguishing content from different verification methods |
| Maximum context window | First 6 conversation turns | Match multi-turn verification and reproduction questioning scenarios during penetration testing, retaining context from prior test steps |
| Citation display position | End of paragraph | Align with traceability annotation practices for vulnerability items in penetration test reports, letting viewers quickly locate supporting materials |
| Traceability binding identifier | Project ID prefix | Distinguish cited content across different test projects, avoiding confusion of traceability information between projects |
This document adapts to the configuration logic of FastGPT v4.17.0
Three Common Misconfigurations
- When accessing the application via a non-login share link, the cite original text button appears but does not respond. Cause: Traceability permissions for the share scenario are not enabled in the application configuration, so the shared link cannot load associated document data.
- No citation annotations appear at the end of knowledge base responses. Cause: The
detailconfiguration item is not enabled, or the configuredquoteMaxTokenvalue is too low, leading to truncated or ungenerated cited content. - Context cannot be associated during consecutive questioning, with subsequent responses being irrelevant to the query. Cause: The maximum context window turn limit is not configured, or the window value is too small to retain query information from prior test steps.
How to Verify Successful Configuration
- Initiate a query about a single vulnerability reproduction, check if the document type and identifier of the traceability source appear at the end of the response.
- Switch to the non-login share link, click the cite button in the response to confirm you can jump to the corresponding document content.
- Initiate more than 3 consecutive queries related to test steps, confirm subsequent responses can associate context from prior queries.
- Export the test Q&A records, check if each cited item is bound to the unique identifier of the current project.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.