Customizing the Submission Form
The public submission form is the page where security researchers send you a vulnerability report. CVD Portal hosts it on your portal address, for example acme.cvdportal.com.
Fields on the form
The form has a fixed set of fields. You cannot add, remove or reorder fields.
| Field | Required |
|---|---|
| Affected product | No |
| Vulnerability category (XSS, SQL injection, CSRF, SSRF, RCE, IDOR, authentication bypass, information disclosure, denial of service, hard-coded credentials, insecure firmware or software update, weak or broken cryptography, memory corruption, exposed debug interface, wireless or radio protocol, other) | No |
| Summary (description), 10 to 10,000 characters | Yes |
| Steps to reproduce | No |
| Security impact | No |
| Contact email | No |
| PGP public key | No |
| AI tools used (yes or no) | No |
| How the researcher confirmed it (reproduced on a running system, confirmed in source code only, not confirmed) | No |
The form has no file upload. Researchers put proof-of-concept details in the text fields.
What you can change
- Product list. The "Affected product" field shows the products in your Hardware Registry (Settings → Hardware Registry). When a researcher selects a product, the portal stores its identifier with the report. If the registry is empty, the field shows one "Unknown product" option. See Hardware Registry.
- Branding. On the Enterprise plan, you can set the portal logo and brand color in Settings → General.
- Language. The form shows its labels in the language set for your portal.
AI-assisted reports
The two method fields show how the researcher found and confirmed the finding. They come from the ENISA and CERT-EU joint advisory on frontier AI for code review (November 2026). In that experiment, AI tools rated 42 of 88 assessed findings critical or high. After review, the code owners rated 22 of the 88 high.
The submission page shows the answers under Reporter's method. When the researcher confirmed the finding in source code only, or did not confirm it, the page asks you to check the claimed severity against your deployment.
The fields are a statement by the researcher. The portal never sets a severity, a status or an Article 14 decision from them. When the researcher leaves a field empty, the page shows nothing for it.
Researchers and their agents can also send both fields through the public MCP tool submit_vulnerability_to_vendor, as aiAssisted and reporterVerification.
Anonymous reports
The contact email is optional. A researcher can send a report without an email address. You then cannot send an acknowledgment or a request for information to that researcher.
Data protection
The portal sends all data over HTTPS. The portal encrypts the description, steps to reproduce, impact, contact email and PGP key fields before it stores them, when the field encryption key is set on the server.