Skip to main content

VulnerabilityDisclosureMessage

A single message in a VDR thread — either inbound (from the researcher) or outbound (from a triager).

type VulnerabilityDisclosureMessage {
  author: PortalUser
  body: String!
  createdAt: ISO8601DateTime!
  direction: String!
  id: ID!
  submissionId: Int!
}

Fields​

VulnerabilityDisclosureMessage.author ● PortalUser object​

Always null for inbound (researcher) messages

VulnerabilityDisclosureMessage.body ● String! non-null scalar​

Inbound (researcher) bodies are HTML-escaped server-side on write (T8), the same as VulnerabilityDisclosureSubmission#description — entities, not plain text; the payload is preserved verbatim but inert. Outbound (triager) bodies are stored as typed. Render via the platform's MarkdownRender (DOMPurify-backed) — never v-html, since only the inbound half is escaped.

VulnerabilityDisclosureMessage.createdAt ● ISO8601DateTime! non-null scalar​

VulnerabilityDisclosureMessage.direction ● String! non-null scalar​

inbound or outbound

VulnerabilityDisclosureMessage.id ● ID! non-null scalar​

VulnerabilityDisclosureMessage.submissionId ● Int! non-null scalar​

Member Of​

ReplyToDisclosurePayload object ● VulnerabilityDisclosureSubmission object

Contribute to the Docs

Found something outdated or missing? Help us improve the documentation with a quick suggestion or edit.

How to contribute

Resources

By exploring our content, you'll find resources that will enhance your understanding of the importance of a Security Application Program.

Conviso Blog: Explore our blog, which offers a collection of articles and posts covering a wide range of AppSec topics. The content on the blog is primarily in English.

Conviso's YouTube Channel: Access a wealth of informative videos covering various topics related to AppSec. Please note that the content is primarily in Portuguese.