What data for this category looks like
The data for this category primarily comes from target systems, public vulnerability databases, automated scanner results, and manual attack verification records. Data is updated during individual project delivery cycles or during major version iterations. Daily produced documents include test authorization letters, penetration test reports, vulnerability reproduction records, and rectification suggestions. Document fields cover authorization scope, vulnerability IDs, exploitation paths, risk ratings, and more. Core linked processes include test authorization confirmation, vulnerability verification, and report rating. Improper exception handling may lead to business interruptions, missed vulnerabilities, or legal authorization disputes.
Constraints imposed by these characteristics on the deployment and upgrade process
Data sources are scattered and rely on multiple external tools and manual inputs, so the deployment process must support importing multi-format documents and connecting to external APIs. Update frequency fluctuates with projects, so the upgrade process must support incremental data synchronization and version rollback mechanisms. Document fields have customization requirements, so adjustable field mapping configurations must be reserved during deployment. The manual verification process generates a large amount of unstructured data, so sufficient storage and computing resources must be configured to support batch processing. Additionally, post-deployment permission control must match the access scope specified in the test authorization letter to avoid unauthorized access risks.
Configuration Settings
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
DB_MAX_LINK | 100–150 connections | Adapts to the concurrent document parsing needs of penetration testing services, prevents database connection pool exhaustion |
MONGODB_URI | Configure a dedicated connection string based on project storage requirements | Stores unstructured data such as vulnerability reproduction records and penetration test reports, isolates business and test data |
REDIS_URL | redis://:custom password@deployment address:6379/0 | Caches scanner results and temporary verification data, reduces repeated query overhead |
STORAGE_S3_ENDPOINT | Fill in the object storage service address matching the deployment environment | Stores batch-uploaded test authorization letters and vulnerability scan logs, adapts to large-volume document storage needs |
FE_DOMAIN | Fill in the intranet or public network access domain name | Matches the access scope configured in the test authorization letter, avoids cross-domain access exceptions |
Three Common Misconfigurations
- Phenomenon: Interruptions occur when batch uploading large volumes of test documents or vulnerability scan logs, and parsing progress cannot be restored after restarting Docker containers. Cause:
DB_MAX_LINKis not properly configured, leading to database connection pool exhaustion, and the breakpoint resume flag is not enabled, so parsing progress is lost after interruption. - Phenomenon: After configuring a scheduled task, the task cannot start automatically after the server or Docker restarts. Cause:
REDIS_URLis not correctly configured to cache task scheduling status, and local temporary storage is used, resulting in loss of task information after restart. - Phenomenon: Vulnerability library data fails to load after enabling the MinerU tool. Cause:
STORAGE_S3_ENDPOINTis not configured to point to the vulnerability library storage address, resulting in resource loading failure.
How to Verify Correct Configuration
- Perform a batch import operation for test authorization letters, check whether the import progress is continuous with no unexpected interruptions, and verify that the imported data fields match the preset mappings.
- Check the database connection pool monitoring logs, confirm that the number of connections does not exceed the
DB_MAX_LINKconfiguration range, and there are no persistent connection errors. - After restarting the Docker container, verify that the scheduled scan task automatically resumes running, and the cached temporary verification data is not lost.
- Access the configured
FE_DOMAIN, confirm that the penetration test report preview page loads normally based on FastGPT v4.17.0, and there are no resource loading failure prompts.
The values provided are common starting points and should be evaluated against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.