Skip to main content

CSAF Export & Publishing

The Common Security Advisory Framework (CSAF) is the modern standard for machine-readable vulnerability advisories. Exporting and publishing your vulnerability data in CSAF format is increasingly becoming a mandate for regulatory compliance, including under the Cyber Resilience Act (CRA), as it enables automated ingestion and analysis by downstream consumers and ecosystem partners. The CVD Portal fully automates the generation and distribution of CSAF documents.

When a vulnerability reaches the disclosure phase, the portal automatically compiles the relevant data-including CVSS scores, affected product versions, remediation details, and descriptions-into a compliant CSAF JSON format. This eliminates the manual effort and potential for errors associated with crafting traditional, human-readable advisories. The portal supports multiple CSAF profiles, ensuring compatibility with various industry requirements.

Publishing CSAF documents allows your customers and partners to automatically update their security tooling, drastically reducing the time it takes for the broader ecosystem to protect against newly disclosed threats. The portal can securely host these documents or integrate with your existing content delivery networks, providing a verifiable and reliable source of truth for your organization's security advisories.

Where your CSAF documents are published​

Your portal serves a complete CSAF 2.0 directory-based distribution.

  • /.well-known/csaf/provider-metadata.json is the entry point, and the URL your security.txt CSAF field advertises
  • /.well-known/csaf/white/index.txt lists every published document
  • /.well-known/csaf/white/changes.csv lists them again with their last change date, newest first
  • /.well-known/csaf/white/<year>/<advisory-ref>.json is a single advisory

Custom domains​

If you are on Enterprise and have verified a custom domain, your whole portal is served from that host, and every URL the CSAF distribution advertises follows it. The canonical_url, the publisher namespace, and the distribution directory URL all use your own domain rather than your .cvdportal.com subdomain. So does the CSAF field in both security.txt files, the one your portal serves at /.well-known/security.txt and the one it generates for you to publish on your own apex domain.

Your .cvdportal.com subdomain keeps serving the same documents, so any link published before you added the custom domain still resolves. Advisory file paths never contain a host, so adding or changing a custom domain does not move a single published advisory.

Verify the domain before you publish your security.txt. Until the DNS challenge passes, the portal still advertises the .cvdportal.com subdomain, because an unverified domain is not yet known to point at us.

OpenVEX export​

Every published advisory is also available as an OpenVEX v0.2.0 document at /advisories/<advisory-ref>/openvex. The download link sits beside the CSAF link on the advisory page.

Both documents read the same advisory record, so they state the same facts in two vocabularies. Use CSAF when the consumer expects a full advisory with scores and credits. Use OpenVEX when the consumer only needs the exploitability status, which is the common case for a dependency scanner.

Three fields exist in CSAF and have no equivalent in OpenVEX, so the OpenVEX document leaves them out.

  • Severity. OpenVEX carries no score.
  • Researcher credit. OpenVEX has no acknowledgment field.
  • The product name. OpenVEX identifies a product by IRI, purl or CPE, so the portal puts the product name in status_notes where a reader can still see it.

The status vocabulary is the OpenVEX one, unmodified. A published advisory is fixed. An advisory that is not yet published is affected and always carries an action_statement.

The OpenVEX export uses the same plan gate as the CSAF export. Human-readable disclosure stays free because the CRA requires it.