Explain this Vulnerability: Document what data is sent to the 3rd Party

Why are we doing this work

As part of https://gitlab.com/gitlab-org/gitlab/-/issues/412712+ we need to document what data is sent to the 3rd party. This was raised by our Sales and Customer Support teams during the AMA. Having it easily discoverable will be helpful.

Add Explain this Vulnerability to AI docs (#409866 - closed) added initial documentation to https://docs.gitlab.com/ee/user/ai_features.html#explain-this-vulnerability-in-the-web-ui. We can extend this page with a list of data points we send to to the 3rd party AI APIs:

  1. Vulnerability title (which may contain the filename based on the scanner)
  2. Vulnerability identifiers
  3. Code block (single and multi-line as instructed by the vulnerability record)
  4. Filename (soon to be generalized within Explain this Vulnerability: Generalize the file... (#414322 - closed))
  5. ?

Resources

Prompt code https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/lib/gitlab/llm/templates/explain_vulnerability.rb?ref_type=heads#L59-94

Relevant links

Non-functional requirements

  • Documentation:
  • Feature flag:
  • Performance:
  • Testing:

Implementation plan

Verification steps

Edited by Neil McCorrison