What the data for this category looks like
Typical users of this category are security R&D, security service providers, and R&D teams. Documents maintained daily include four types: code audit reports, vulnerability proofs, repair suggestions, and retest records. Document structures typically include fields such as vulnerability ID, risk level, associated code snippets, repair solutions, and retest results. Data sources include source code repositories, dependency lists, static application security testing (SAST) tool outputs, and public vulnerability databases. Updates follow project version iterations: corresponding documents are updated each time an audit or retest for a version is completed, with no fixed cycle.
What constraints these characteristics impose on the knowledge base retrieval and recall link
Code security audit documents contain large numbers of code snippets and technical details. Retrieval must balance semantic matching and syntax consistency, to avoid recalling generic vulnerability documents unrelated to the current scenario. Data sources are scattered and updated with project iterations. Retrieval scope must be strictly limited to the current project’s exclusive knowledge base set, to prevent interference from cross-project documents. Document fields include risk level and associated code. Retrieval must prioritize recalling high-risk level documents, while supporting precise matching by code snippet semantics. In on-call operations and ticket scenarios, results must be obtained quickly. Retrieval processes must control response time, to avoid long waits affecting duty efficiency.
How to configure the settings
These configurations are based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
similarity | 0.75–0.85 | Semantic matching for code snippets requires a relatively high threshold to avoid mixing in low-relevance results, while covering scenarios of the same vulnerability with different code implementations |
limit | Top 8 entries | Fast browsing of results is required in on-call operations scenarios; too many entries increase manual review burden, while ensuring coverage of core associated documents |
searchMode | vector | Code security audit documents contain large amounts of code and technical details; vector retrieval is better suited to semantic matching needs than keyword retrieval |
usingReRank | Enabled | Similarity of code snippets can be easily disrupted by surface-level differences; re-ranking filters out semantically unmatched results and improves recall accuracy |
datasetSearchUsingExtensionQuery | Enabled | Operations tickets often include vague vulnerability descriptions; extended queries can link to specific code audit reports and repair suggestions |
collectionIds | Bind the current project’s code audit knowledge base set | Ensure retrieval scope is limited to the current project’s compliant documents, avoiding interference from cross-project documents on retrieval results |
Three common configuration mistakes
- Symptom: The console throws an "invalid configuration parameter name "hnsw.iterative_scan"" error. Cause: A retrieval configuration item outside the FastGPT allowed parameter list is used, and an unspecified parameter is incorrectly introduced.
- Symptom: Retrieval results only return 2 entries, failing to cover all vulnerability documents associated with the current ticket. Cause: The
limitconfiguration is set too low, anddatasetSearchUsingExtensionQueryis not enabled, so indirect documents recalled via extended queries cannot be retrieved. - Symptom: Retrieved code audit report snippets have formatting errors, including extra spaces or modified capitalization. Cause: Automatic text formatting is not disabled in the knowledge base configuration, or the retrieval process is incorrectly configured leading to abnormal document preprocessing.
How to confirm the configuration is properly set
- Log in to the FastGPT backend, enter the corresponding knowledge base set page, check if
collectionIdsis bound to the current project’s exclusive document set including code audit reports, vulnerability proofs, and other relevant materials. - Submit a test ticket containing a vague vulnerability description, verify that
datasetSearchUsingExtensionQuerycan recall associated code audit documents and repair suggestions. - View the FastGPT retrieval logs, confirm that the
similarityvalue of returned results falls within the 0.75–0.85 range, and the number of results meets thelimitconfiguration requirements. - Upload a test code snippet, verify that when
searchModeis set tovector, semantically matching code audit reports can be correctly recalled.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.