# Problem to Solve **What does Vulnerability Explanation solve!?** GitLab surfaces vulnerabilities that contain relevant information, however, more often users aren't sure where to start.  It takes time to research and synthesize information that is surfaced within the vulnerability record.  Moreover it can be difficult to figure out how to fix a given vulnerability. **What problem will moving this feature to GitLab Duo chat solve!?** Vulnerability Explanation is helpful for security engineers _and_ developers. Moving the Vulnerability Explanation into GitLab Duo chat will allow users to access this AI feature in vulnerability relevant places throughout GitLab; the merge request, the pipeline security tab, and the Vulnerability Report. Today, Vulnerability Explanation is only available by clicking into a vulnerability from the Vulnerability Report. If a company has a security team, the security engineer: developer ratio is roughly 1:many. It's not scalable to expect a security engineer to triage security findings on all MRs. Security teams want to empower developers to learn more about the risk involved and how to remediate the vulnerability without having to involve them. # Will Vulnerability Explanation be a fit for GitLab Duo Chat? <details><summary><p><strong>1. Can LLMs help solve the problem?</strong></p></summary> <ul> <li>Does the problem require the processing of unstructured text data?<ul> <li>Yes</li> </ul> </li> <li>What is the benefit of such a solution? (typically efficiency)<ul> <li>Efficiency and education and learning </li> <li>There is a 1:many ratio of security engineer to developers, Vulnerability Explanation will enable developers to do work directly in the merge request. This work that would be otherwise done by the security engineers. </li> </ul> </li> <li>What personas would this enable that wouldn’t be able to access this feature otherwise? <ul> <li>Developers</li> </ul> </li> <li>What would change in the workflow if this feature is included in GitLab Duo Chat?<ul> <li>Moving the Vulnerability Explanation into GitLab Duo chat will allow users to access this AI feature in vulnerability relevant places throughout GitLab; the merge request, the pipeline security tab, the Vulnerability Report, and the Dependency List.</li> </ul> </li> </ul> </details> <details><summary><p><strong>2. Does the problem lend itself to a chat?</strong></p></summary> <ul> <li>Is the problem related to one of these three problem spaces: learning, creation, or ideation? <ul> <li>Vulnerability Explain: yes, it is about learning</li> <li>Vulnerability Resolution: yes, it is about creation</li> </ul> </li> <li>Is the workflow centered around one user that needs to do something? <ul> <li>Yes! A user is trying to understand a vulnerability and determine next steps.</li> </ul> </li> <li>Is it possible that the AI prediction is not perfect but giving the user a means to ask a follow-up question would allow the user to correct the prediction to achieve what the user wants to achieve?<ul> <li>Yes, however, we would like to control what the user can ask as a followup to optimize the user experience.</li> </ul> </li> <li>Is the problem one that is solved better or more easily in an iterative approach?<ul> <li>Yes, we could break down the current explanation into smaller pieces instead of providing everything all at once.</li> </ul> </li> </ul> </details> <details><summary><strong>3. What about the current Vulnerability Explanation feature enhancements that diverge from the chat experience?</strong></summary> <p>Vulnerability Explanation (VE) has feature enhancements that we will need to consider when we move to chat. </p> <ul> <li>VE includes a pre-flight check to make sure users don&#39;t send the prompt to the third party AI if secrets are detected.</li> <li>VE allows users to preview the prompt <em>before</em> sending to to the third party AI.</li> <li>VE allows users to choose whether or not to send code snippet as part of the prompt.</li> </ul> <p>These functionalities are not available today in chat. Instead of building them into chat, we will be putting Vulnerability Explanation behind a toggle so Owners and Maintainers can turn off this feature specifically. Including things like a prompt preview leaves the decision to send the prompt to the end user. These decisions should be made by the organization and not the individual user, hence the feature toggle. </p> </details> <details><summary><strong>4. Is Chat aware of the page it&#39;s on?</strong></summary> <ul> <li> Yes, it works for issues, epics, and code file. It will likely need to be implemented for each page; vulnerabilities, vulnerability findings. Implement this functionality so that chat is aware of a a specific vulnerability, not all vulnerabilities in a project.</li> </ul> </details> <details><summary><strong>5. Will different AI models &quot;play nice&quot; together?</strong></summary> If GitLab Duo and VE are using different AI models, can they work together and deliver a consistent UX?This isn&#39;t validated yet. The vulnerability question would be answered with one model and the followup question would be answered with chat (Claude). </details> <details><summary><strong>6. Can we include pre-defined questions in the prompt?</strong></summary> For example; Is this exploitable?, Explain the exploitability, etc. Yes, but you can&#39;t put boundaries on what the followup questions are. There is general guidance, i.e. if you don&#39;t know the answer, don&#39;t answer it. There are also guardrails today that limit us only to ask questions about DevSecOps. We may remove this limitation to get better answers on the other questions. It is unclear how effective these guardrails are today. For these example questions to be page-dependent, we would need to implement this functionality. That chat is aware of previous conversations, even when you close and reopen that chat on a new page. If you change pages the chat won&#39;t clear and the predefined questions for the specific page won&#39;t appear, unless you use<code>/clean</code>. </details> <details><summary><strong>7. Can we provide followup actions?</strong></summary> We want to provide follow-up actions, i.e. create an MR with solution proposed (Vulnerability Resolution). We could do this with quick actions. A future iteration might be offering a choice of actions. </details> # Proposal Vulnerability Explanation is available in GitLab Duo Chat on any vulnerability or vulnerability finding record. It can be accessed by using a quick action `/vuln_explain`. If the chat is new, and the user is on a vulnerability page, then the user is given prompts to explain the vulnerability.