Search for the official CPE entry for the software product either by using the NVD's CPE search engine or in the official CPE dictionary (warning, very large XML file). Do not ever make up CPE data.

Add cpe to USES and compare the result of make -V CPE_STR to the CPE dictionary entry. Continue one step at a time until make -V CPE_STR is correct.

If the product name (second field, defaults to PORTNAME) is incorrect, define CPE_PRODUCT.

If the vendor name (first field, defaults to CPE_PRODUCT) is incorrect, define CPE_VENDOR.

If the version field (third field, defaults to PORTVERSION) is incorrect, define CPE_VERSION.

If the update field (fourth field, defaults to empty) is incorrect, define CPE_UPDATE.

If it is still not correct, check Mk/Uses/cpe.mk for additional details, or contact the Ports Security Team <ports-secteam@FreeBSD.org>.

Derive as much as possible of the CPE name from existing variables such as PORTNAME and PORTVERSION. Use variable modifiers to extract the relevant portions from these variables rather than hardcoding the name.

Always run make -V CPE_STR and check the output before committing anything that changes PORTNAME or PORTVERSION or any other variable which is used to derive CPE_STR.