Skip to main content

CSAF Export & Publishing

The Common Security Advisory Framework (CSAF) is the modern standard for machine-readable vulnerability advisories. Exporting and publishing your vulnerability data in CSAF format is increasingly becoming a mandate for regulatory compliance, including under the Cyber Resilience Act (CRA), as it enables automated ingestion and analysis by downstream consumers and ecosystem partners. The CVD Portal fully automates the generation and distribution of CSAF documents.

When a vulnerability reaches the disclosure phase, the portal automatically compiles the relevant data-including CVSS scores, affected product versions, remediation details, and descriptions-into a compliant CSAF JSON format. This eliminates the manual effort and potential for errors associated with crafting traditional, human-readable advisories. The portal supports multiple CSAF profiles, ensuring compatibility with various industry requirements.

Publishing CSAF documents allows your customers and partners to automatically update their security tooling, drastically reducing the time it takes for the broader ecosystem to protect against newly disclosed threats. The portal can securely host these documents or integrate with your existing content delivery networks, providing a verifiable and reliable source of truth for your organization's security advisories.

Where your CSAF documents are published​

Your portal serves a complete CSAF 2.0 directory-based distribution.

  • /.well-known/csaf/provider-metadata.json is the entry point, and the URL your security.txt CSAF field advertises
  • /.well-known/csaf/white/index.txt lists every published document
  • /.well-known/csaf/white/changes.csv lists them again with their last change date, newest first
  • /.well-known/csaf/white/<year>/<advisory-ref>.json is a single advisory

Custom domains​

If you are on Enterprise and have verified a custom domain, your whole portal is served from that host, and every URL the CSAF distribution advertises follows it. The canonical_url, the publisher namespace, and the distribution directory URL all use your own domain rather than your .cvdportal.com subdomain. So does the CSAF field in both security.txt files, the one your portal serves at /.well-known/security.txt and the one it generates for you to publish on your own apex domain.

Your .cvdportal.com subdomain keeps serving the same documents, so any link published before you added the custom domain still resolves. Advisory file paths never contain a host, so adding or changing a custom domain does not move a single published advisory.

Verify the domain before you publish your security.txt. Until the DNS challenge passes, the portal still advertises the .cvdportal.com subdomain, because an unverified domain is not yet known to point at us.