Customizing the Submission Form
The public submission form is the page where security researchers send you a vulnerability report. CVD Portal hosts it on your portal address, for example acme.cvdportal.com.
Fields on the form
The form has a fixed set of fields. You cannot add, remove or reorder fields.
| Field | Required |
|---|---|
| Affected product | No |
| Vulnerability category (XSS, SQL injection, CSRF, SSRF, RCE, IDOR, authentication bypass, information disclosure, denial of service, other) | No |
| Summary (description), 10 to 10,000 characters | Yes |
| Steps to reproduce | No |
| Security impact | No |
| Contact email | No |
| PGP public key | No |
The form has no file upload. Researchers put proof-of-concept details in the text fields.
What you can change
- Product list. The "Affected product" field shows the products in your Hardware Registry (Settings → Hardware Registry). When a researcher selects a product, the portal stores its identifier with the report. If the registry is empty, the field shows one "Unknown product" option. See Hardware Registry.
- Branding. On the Enterprise plan, you can set the portal logo and brand color in Settings → General.
- Language. The form shows its labels in the language set for your portal.
Anonymous reports
The contact email is optional. A researcher can send a report without an email address. You then cannot send an acknowledgment or a request for information to that researcher.
Data protection
The portal sends all data over HTTPS. The portal encrypts the description, steps to reproduce, impact, contact email and PGP key fields before it stores them, when the field encryption key is set on the server.