What data falls under this category
Data for this category covers the full lifecycle of single-project security vulnerabilities. Sources include private vulnerability reports, hosted code repositories, CVE number issuing bodies, and official release channels. Daily documents include security advisories, vulnerability detail reports, fix patches, CVE application materials, and more. Each data entry is bound to a corresponding project identifier, and includes fields such as vulnerability ID, impact scope, fix status, disclosure time, and additional relevant details. Updates are triggered by individual vulnerability events, with no fixed schedule.
What constraints do these characteristics impose on permissions and data isolation
Private vulnerability reports may only be accessed by the project security response team and authorized maintainers. This prevents unauthorized personnel from obtaining sensitive information in advance. Vulnerability data from different projects must be strictly isolated to prevent cross-project leakage of vulnerability information. CVE application materials involve sensitive project information, and must be bound to exclusive team and knowledge base permissions. Patch packages must be restricted to only be distributed to operations personnel with verified permissions. This avoids premature patch releases. Additionally, data updates are event-triggered, so permission configurations must support temporary authorization and expiration revocation to adapt to the temporary collaboration needs of vulnerability handling.
How to configure settings
The following configurations are based on FastGPT v4.17.0.
| Configuration Item | Recommended Setting | Rationale |
|---|---|---|
teamId binding | Bind the exclusive security response team's teamId | Bind vulnerability handling data to a dedicated team to achieve team-level isolation |
tmbId binding | Bind the exclusive tmbId for vulnerability handling | Achieve knowledge base template-level isolation, limiting data access scope |
| Temporary authorization validity period | 72 hours | Adapt to the short-term collaboration needs of vulnerability handling, automatically revoke permissions upon expiration |
| Maximum number of authorized users per single authorization | 10 | Limit the scope of temporary collaboration to reduce leakage risks |
| Patch package access restrictions | Only open to members with the operations on-call team's teamId, and single files must not exceed 500 MB | Prevent premature patch distribution and avoid abuse of large file permissions |
| Permission check trigger | Every ticket and knowledge base query request | Ensure that every data access undergoes permission verification |
Three Common Configuration Errors
- Symptom: The interface displays "No permission to access knowledge base", and a
teamIdmismatch error appears in the logs. Cause: The vulnerability handling knowledge base was not bound to the correspondingteamId, causing unauthorized teams to fail to access expected data. - Symptom: After restarting the Docker service, a SQL error about database permission denial occurs. Cause: The permission configuration volume was not remounted after the container restart, causing the FastGPT service to fail to read the isolated permission configuration files.
- Symptom: Temporary authorized members can still access vulnerability data from other projects. Cause: Knowledge base isolation at the
tmbIdlevel was not configured, leading to cross-project data leakage.
How to Confirm Successful Configuration
- Log in to the FastGPT backend, view the member list bound to
teamId, and confirm that only authorized security response team members are visible. - Initiate a ticket and knowledge base query request from an unauthorized member, and verify that a no permission access prompt is returned.
- After restarting the Docker service, check the FastGPT service logs to confirm that there are no database permission related errors.
- Switch to an account bound to a different
tmbId, and verify that the vulnerability-exclusive knowledge base for the current project cannot be accessed.
The values provided here are common starting points, and should be evaluated against the samples from the actual deployment.
Question material comes from public community discussions. Configuration values are common starting points and should be measured against your own samples. Verified on 2026-10-19.