歡迎大家來上這堂寫給開發者的資訊安全課。 Welcome everyone to this lesson on information security for developers.
今天要談的是：用 AI vibe coding 時，怎麼把軟體做得夠安全再上線。 Today we're going to talk about how to ship secure software when you vibe code with AI.
動手寫任何程式之前，你第一個要有的東西是威脅模型。 So, um, the first thing you need is a threat model before you write any code.
威脅模型說白了就是問：誰可能攻擊它？我的攻擊面在哪裡？ A threat model just means asking, who might attack this, and what's my attack surface?
到了 2024 年，最常見的漏洞還是 SQL Injection。 The most common vulnerability is still SQL Injection, even in 2024.
它發生在你沒先淨化使用者輸入、就把資料丟進資料庫的時候。 It happens when you don't sanitize user input before it hits your database.
第二個你會很常遇到的是 Cross-Site Scripting，也就是 XSS。 The second one you'll see a lot is Cross-Site Scripting, or XSS.
XSS 能讓攻擊者把攻擊載荷跑在別人的瀏覽器 session 裡。 XSS lets an attacker run their payload inside another user's browser session.
vibe coding 有個重點：LLM 會很樂意生出不安全的程式碼。 Now, here's the thing about vibe coding, the LLM will happily generate insecure code.
我看過 Copilot 直接把密鑰寫死在原始碼裡，像是 API key。 I've seen Copilot hardcode a secret right into the source, like an API key.
第一條規則：絕不要把寫死的密鑰 commit 上去，改用環境變數。 Rule number one, never commit a hardcoded secret, use environment variables.
第二條規則：每一組憑證都要套用最小權限原則。 Rule number two, always apply the principle of least privilege to every credential.
如果一個 token 只需要讀取，就別給它寫入權限。 If a token only needs to read, don't give it write access, you know?
AI agent 另一個大風險是提示詞注入。 Another big risk with AI agents is prompt injection.
提示詞注入基本上就是社交工程，只是目標從人換成你的模型。 Prompt injection is basically social engineering, but aimed at your model instead of a person.
也要盯緊你的相依套件，供應鏈攻擊會污染一個你信任的套件。 Also watch your dependencies, a supply chain attack can poison a package you trust.
上線之前，先對自己的端點做一些基本的滲透測試。 Before you deploy, run some basic penetration testing against your own endpoints.
拜託一定要加速率限制，別讓人可以暴力破解你的登入。 And please, add rate limiting so nobody can brute force your login.
把密碼做雜湊，絕不要用明文存，還要加鹽。 Hash your passwords, never store them in plain text, and add a salt.
當一個 zero-day 爆出來，手上有沒有備好修補程式，就是從容跟兵荒馬亂的差別。 When a zero-day drops, having patches ready is the difference between calm and chaos.
好，總結一下：資安不是你最後才補上的功能。 Okay, so to recap, security is not a feature you add at the end.
它是一種你從第一行程式就帶著的心態，就算你在 vibe coding 也一樣。 It's a mindset you bring from the very first line, even when you vibe code.