4 ms·
You need to drop your source code into some LLMs and ask for a security review - there's lots of holes.
by wewewedxfgdf 1y ago
You need to drop your source code into some LLMs and ask for a security review - there's lots of holes.
- ozgrakkurt 1y agoYou should get the LLM to create a couple dozen issues on github automatically and let the author review it!! /s
- wewewedxfgdf 1y agoWell we presume the author actually wants his framework to be secure.
- benbristow 1y agoLet the LLM review the issues and resolve the issues. LLM all around, hail Skynet.
- pylotlight 1y agoOh yes, because LLMs are known for good security practices.
- wewewedxfgdf 1y agoI did not want to embarrass the author but the LLM showed that this library is absolutely full of major security holes. And yes, it's an LLM that pointed them out. So, are you saying the security holes don't exist because an LLM found them?
- trueadm 1y agoPlease can you create a Github issue with the security holes you've found? That would be greatly appreciated. I've given it a sweep and found nothing.
- wewewedxfgdf 1y agoMake a minimal zip of the the source code only (cut out anything not source code) drop it into ChatGPT and say "analyse this code for security flaws". Then ask it for more. Then do the same this with Google AI studio - drop the zipfile in and ask it to analyse for security flaws.
- brazukadev 1y agoIf you already did so why not share the answers you got?
- Terretta 1y agoSibling's proposed approach is a recipe for false positives. Consider Claude Code's new /security-review prompt or just use the prompt starting from "Objective" after giving the context (see the Git shell commands) to Claude Opus 4.1. https://raw.githubusercontent.com/anthropics/claude-code-security-review/refs/heads/main/.claude/commands/security-review.md https://raw.githubusercontent.com/anthropics/claude-code-sec... Definitely Opus 4.1 though, not lesser.
- wewewedxfgdf 1y agoI suggest do both.