CodeQL's 'ai threat model' won't start without defining sources — 8 items for an LLM Output Source Contract

I added threat-models: ai to my CodeQL workflow. Now I want to think that if LLM output flows into SQL execution or a shell, ...
InfoQ

GitHub Enhances CodeQL with Declarative Security Modeling for Faster, More Flexible Analysis

Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with content, and download exclusive resources. Lily Mara explains how to avoid high-risk ...

CodeQLの「ai threat model」は、sourceを定義しなければ始まらない――LLM Output Source Contract 8項目

CodeQLのworkflowにthreat-models: aiを加えた。これでLLMの出力がSQL実行やshellへ流れたら検出できる――そう考えたくなります。 ところがCodeQL 2.27.3の公式告知には、ai threat ...