Skip to main content

CSAF Export & Publishing

The Common Security Advisory Framework (CSAF) is the modern standard for machine-readable vulnerability advisories. Exporting and publishing your vulnerability data in CSAF format is increasingly becoming a mandate for regulatory compliance, including under the Cyber Resilience Act (CRA), as it enables automated ingestion and analysis by downstream consumers and ecosystem partners. The CVD Portal generates and serves CSAF documents for your published advisories. CSAF export requires the Reporting plan or higher.

When you publish a security advisory, the portal serves it as a CSAF 2.0 document with the csaf_vex profile. The document comes from the advisory record. It holds the title, the summary, the affected product, the fixed version, the severity, the CVE identifier and, when the researcher agreed, the researcher credit. You can also download a CSAF document with the csaf_security_advisory profile for one submission from the submission page.

Your customers and partners can read these documents with their own security tools. The portal hosts the documents on your portal host. It does not publish them to other servers or content delivery networks.

Where your CSAF documents are published​

Your portal serves a complete CSAF 2.0 directory-based distribution.

  • /.well-known/csaf/provider-metadata.json is the entry point, and the URL your security.txt CSAF field advertises
  • /.well-known/csaf/white/index.txt lists every published document
  • /.well-known/csaf/white/changes.csv lists them again with their last change date, newest first
  • /.well-known/csaf/white/<year>/<advisory-ref>.json is a single advisory

Custom domains​

If you are on Enterprise and have verified a custom domain, your whole portal is served from that host, and every URL the CSAF distribution advertises follows it. The canonical_url, the publisher namespace, and the distribution directory URL all use your own domain rather than your .cvdportal.com subdomain. So does the CSAF field in both security.txt files, the one your portal serves at /.well-known/security.txt and the one it generates for you to publish on your own apex domain.

Your .cvdportal.com subdomain keeps serving the same documents, so any link published before you added the custom domain still resolves. Advisory file paths never contain a host, so adding or changing a custom domain does not move a single published advisory.

Verify the domain before you publish your security.txt. Until the DNS challenge passes, the portal still advertises the .cvdportal.com subdomain, because an unverified domain is not yet known to point at us.

OpenVEX export​

Every published advisory is also available as an OpenVEX v0.2.0 document at /advisories/<advisory-ref>/openvex. The download link sits beside the CSAF link on the advisory page.

Both documents read the same advisory record, so they state the same facts in two vocabularies. Use CSAF when the consumer expects a full advisory with scores and credits. Use OpenVEX when the consumer only needs the exploitability status, which is the common case for a dependency scanner.

Three fields exist in CSAF and have no equivalent in OpenVEX, so the OpenVEX document leaves them out.

  • Severity. OpenVEX carries no score.
  • Researcher credit. OpenVEX has no acknowledgment field.
  • The product name. OpenVEX identifies a product by IRI, purl or CPE, so the portal puts the product name in status_notes where a reader can still see it.

The status vocabulary is the OpenVEX one, unmodified. A published advisory is fixed. An advisory that is not yet published is affected and always carries an action_statement.

The OpenVEX export uses the same plan gate as the CSAF export. Human-readable disclosure stays free because the CRA requires it.