What Data for This Category Looks Like
The data for this category primarily comes from source code repositories, dependency manifests, Static Application Security Testing (SAST) tools, and public vulnerability databases. Daily produced documents include code audit reports, vulnerability proof materials, remediation recommendation documents, and retest records. Data is updated after each project version iteration or completion of a single audit. A single record typically includes fields such as vulnerability severity, associated function path, fixed code snippet, and project identifier. There is no uniform fixed length, and it varies based on audit complexity.
Constraints These Characteristics Impose on Reranking and Hybrid Retrieval
Code security audit data is a mix of structured and semi-structured content, with large variations in single-record length. This causes significant fluctuations in the relevance of recalled results during hybrid retrieval. Data updated per project version must retain context associated with the current project during retrieval, to avoid invalid cross-project recalls. Manually reviewed business logic and attack path data requires the reranking model to accurately match users’ operations on-duty queries. Basic similarity matching alone cannot cover business details. Additionally, the association between retest records and remediation recommendations requires the reranking step to preserve contextual relationships between data, avoiding loss of critical logic after splitting.
Configuration Settings
This configuration applies to FastGPT v4.17.0 and later versions.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
| Reranking Toggle | Enabled | Adapts to the complex semantic matching requirements of code security audit data, filters low-relevance recalled results |
| Similarity Threshold | 0.72–0.85 | Matches the semantic similarity range for code-related data, avoids missing recalled results related to high-severity vulnerabilities |
| Single Recall Limit | Top 8–12 results | Balances retrieval efficiency and recall coverage, adapts to the context length limit of single operations on-duty queries |
| Retrieval Mode | Hybrid Retrieval | Combines vector retrieval and keyword retrieval, adapts to the mixed structured and semi-structured characteristics of code audit reports |
| Reranking Recall Limit | Top 4–6 results | Focuses on high-relevance results, adapts to the fast query requirements of operations on-duty |
| Reranking Model Adaptation | Calibrated via actual testing | Adapts to mainstream reranking models such as Qwen3-Reranker-8B, bge-reranker series, and matches computing resource configurations |
Three Common Misconfigurations
- Phenomenon: After deploying the reranking model, local testing passes, but the reranking result returned during online retrieval is marked as false. Cause: The API address or key of the corresponding reranking model was not bound in the FastGPT configuration, or the configured model version does not match the deployed version.
- Phenomenon: When a single document in the knowledge base exceeds 8000 characters, the reranking step is not triggered. Cause: The system has a default single-document length limit for reranking triggers, and the threshold was not adjusted for the long text content of code audit reports.
- Phenomenon: The relevance ranking of retrieval results does not match actual business requirements, with high-severity vulnerability information ranked after low-severity content. Cause: The scoring weight of the reranking model was not adjusted based on the business priority of code security audits, or the similarity threshold was set too low, resulting in irrelevant content being recalled.
How to Verify Proper Configuration
- Navigate to the FastGPT knowledge base configuration page, check if the reranking toggle is enabled, and confirm that the bound reranking model matches the deployed model.
- Submit a test query containing high-severity vulnerability keywords, verify that the reranking marker of the retrieval results is true, and that the result ranking aligns with business priorities.
- Upload a code audit report longer than 5000 characters, trigger retrieval, and confirm that the reranking step is called normally with no skip prompts.
- Check the system logs to confirm that reranking model call requests were sent normally, with no timeout or error records.
The values provided are common starting points and should be measured against the reader's own samples.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.