第六週：AI 時代的測試與安全

⭐️ Topics 主題

• Secure vibe coding - 用更安全的方式進行 vibe coding
• History of vulnerability detection - 漏洞偵測的演進
• AI-generated test suites - AI 產生的測試套件

🛝 Slides 簡報

1. AI QA, SAST, DAST, and Beyond - AI QA、SAST、DAST 與更多應用安全測試技術 ➡️ 原版 Slides

   ➡️ 中英雙語版 Slides

   https://youtu.be/brztTlU7vXw

2. Isaac Evans, CEO Semgrep

   <aside> 💡

   這週的客座講師沒有分享 Slides

   </aside>

📖 Reading 閱讀

• SAST vs DAST

  SAST vs. DAST vs. RASP: Comparing Application Security Testing Methods | Splunk

• Copilot Remote Code Execution via Prompt Injection

  GitHub Copilot: Remote Code Execution via Prompt Injection

• Finding Vulnerabilities in Modern Web Apps Using Claude Code and OpenAI Codex

  Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex

• [Agentic AI Threats: Identity Spoofing and Impersonation Risks](https://unit42.paloaltonetworks.com/agentic-ai-threats/#:~:text=Identity spoofing and impersonation: Attackers,accurate information exchange are critical.)

• OWASP Top Ten: The Leading Web Application Security Risks

  OWASP Top Ten Web Application Security Risks | OWASP Foundation

• Context Rot: Understanding Degradation in AI Context Windows

  Context Rot: How Increasing Input Tokens Impacts LLM Performance

• Vulnerability Prompt Analysis with O3

  https://github.com/SeanHeelan/o3_finds_cve-2025-37899/blob/master/system_prompt_uafs.prompt

📝 Assignment 作業

• 官方 GitHub 連結 - Writing Secure AI Code