让大模型生成网页应用时加安全要求，结果漏洞更少。
Vibe Coding and Web Application Security: A Twin-Prompt Study
- 用自然语言提示+安全要求生成代码，对比基础版本
- 加安全要求的版本漏洞减少一半以上，无严重问题
- 适合关注AI生成代码安全性的开发者和研究者
大型语言模型正越来越多地从自然语言提示生成完整的网页应用，这引发了一个问题：显式要求安全最佳实践是否能提升生成结果？我们研究了六种功能不同的网页应用，每种均以两种提示变体生成：一种为基线（A），另一种在提示末尾附加了安全要求（B）。所有十二个程序均由同一智能编码助手和同一模型版本在单次非迭代生成中完成，随后通过静态分析、依赖分析、动态测试和人工检测，共确认85个潜在问题中的75个。安全提示版本的每个应用确认问题数更少（24对51），且未发现严重或高危问题；最严重的缺陷仅通过人工测试发现。由于数据集较小且每组仅生成一次，本文报告描述性观察而非统计结论，定位为初步研究，其流程将扩展至多模型和重复实验。
原文摘要 · Abstract (English)
Large language models increasingly generate complete web applications from natural-language prompts, raising the question of whether explicitly requesting security best practice improves the result. We study six functionally distinct web applications, each generated in two prompt variants that are identical except for an appended security-requirements section: a baseline (A) and a security-aware (B) variant. All twelve programs were produced by the same agentic coding assistant and the same model version in a single, non-iterative generation round, and were then analyzed with static, dependency, dynamic and manual techniques, yielding 75 confirmed findings out of 85 candidates. The security-aware variant produced fewer confirmed findings in every application (24 versus 51) and contained no Critical or High issues; the most severe finding was detected only by manual testing. Because the corpus is small and each variant was generated once, we report descriptive observations rather than statistically established effects, and position the work as a preliminary study whose pipeline is being scaled to multiple models and repeated runs.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。