Skip to main content

VulnerabilityDisclosureSubmission

A vulnerability disclosure report received from an external researcher. Carries third-party PII (researcherEmail, reporterIp): reading it requires vulnerability_read plus a grant on the owning company or on the FQDN asset of the Trust Center the report came in through. Not gated on an admin flag — see Trust::DisclosureSubmissionPolicy.

type VulnerabilityDisclosureSubmission {
  acceptableAssetIds: [Int!]!
  affectedUrl: String
  createdAt: ISO8601DateTime!
  description: String!
  id: ID!
  linkedIssueId: Int
  messages: [VulnerabilityDisclosureMessage!]!
  reporterIp: String
  researcherEmail: String!
  researcherName: String
  scopeId: Int!
  severityGuess: String!
  status: String!
  stepsToReproduce: String
  title: String!
  triager: PortalUser
  updatedAt: ISO8601DateTime!
  verifiedAt: ISO8601DateTime
}

Fields​

VulnerabilityDisclosureSubmission.acceptableAssetIds ● [Int!]! non-null scalar​

Assets acceptDisclosureAndCreateIssue will accept for this submission: the Trust Center's FQDN plus everything its relationship graph reaches. Use it to scope the asset picker; anything outside is refused as RecordNotFound. Single-record only.

VulnerabilityDisclosureSubmission.affectedUrl ● String scalar​

VulnerabilityDisclosureSubmission.createdAt ● ISO8601DateTime! non-null scalar​

VulnerabilityDisclosureSubmission.description ● String! non-null scalar​

Researcher-authored, HTML-escaped server-side on write (T8) — the payload is preserved verbatim but inert. Render via MarkdownRender or v-html; {{ }} would show the entities literally.

VulnerabilityDisclosureSubmission.id ● ID! non-null scalar​

VulnerabilityDisclosureSubmission.linkedIssueId ● Int scalar​

Set after a triager promotes the submission via acceptDisclosureAndCreateIssue. Survives a soft delete of that issue: the report stays accepted, and this is the id it was accepted into.

VulnerabilityDisclosureSubmission.messages ● [VulnerabilityDisclosureMessage!]! non-null object​

VulnerabilityDisclosureSubmission.reporterIp ● String scalar​

VulnerabilityDisclosureSubmission.researcherEmail ● String! non-null scalar​

VulnerabilityDisclosureSubmission.researcherName ● String scalar​

VulnerabilityDisclosureSubmission.scopeId ● Int! non-null scalar​

VulnerabilityDisclosureSubmission.severityGuess ● String! non-null scalar​

VulnerabilityDisclosureSubmission.status ● String! non-null scalar​

VulnerabilityDisclosureSubmission.stepsToReproduce ● String scalar​

VulnerabilityDisclosureSubmission.title ● String! non-null scalar​

HTML-escaped server-side on write (T8), so it is inert even under v-html. Render with MarkdownRender or v-html; {{ }} would show the entities literally.

VulnerabilityDisclosureSubmission.triager ● PortalUser object​

VulnerabilityDisclosureSubmission.updatedAt ● ISO8601DateTime! non-null scalar​

VulnerabilityDisclosureSubmission.verifiedAt ● ISO8601DateTime scalar​

Returned By​

vulnerabilityDisclosureSubmission query ● vulnerabilityDisclosureSubmissions query

Member Of​

AcceptDisclosureAndCreateIssuePayload object ● ReplyToDisclosurePayload object ● StartDisclosureTriagePayload object ● TransitionDisclosureSubmissionPayload object

Contribute to the Docs

Found something outdated or missing? Help us improve the documentation with a quick suggestion or edit.

How to contribute

Resources

By exploring our content, you'll find resources that will enhance your understanding of the importance of a Security Application Program.

Conviso Blog: Explore our blog, which offers a collection of articles and posts covering a wide range of AppSec topics. The content on the blog is primarily in English.

Conviso's YouTube Channel: Access a wealth of informative videos covering various topics related to AppSec. Please note that the content is primarily in Portuguese.