我们发现了什么
Show HN：指导 AI 编程智能体安全使用库。嗨，HN，简而言之：AI 代码安全卡为编程智能体提供针对特定库和版本的指导，以生成更安全的代码。
- 来源：Hacker News（发现于 2026-08-05）
- 证据等级：D · 发现产品或需求信号，暂未获得可核验的商业证据。
- 商业模式：待核验
- 主题：开发者工具
- 初筛评分：18.2/100 · 收录 1 次
证据，比故事更重要。
规则清洗与初筛，未经人工商业核验。原文语境、实际客户和付费情况仍需自行验证。
引用与数字披露
来源类型（原作者自述／第三方测算／媒体转引）需采集端标注，本版尚未落字段。
- 作者
- 未标注
- 抓取日期
- 来源类型
- 未标注
- 币种
- 未标注
- 口径
- 未标注
- 披露主体
- 未标注
- 披露日期
- 未标注
中文辅助译文（全文）
大家好 HN，TL;DR：AI Code Security Cards（AI 代码安全卡）为编码代理提供特定于库和版本的安全指导，以生成更安全的代码。AI 编码代理能够生成可运行的代码，但它们往往缺乏特定于库和版本的安全知识。我们开发了 AI Code Security Cards——一个开源的安全知识层——以提供这部分缺失的上下文。该项目与我的博士学位研究相关，我的研究重点是 LLM 生成代码的安全性。在研究过程中，我研究了代码生成模型的行为方式、它们如何引入安全问题，以及如何引导它们生成更安全的代码。我的研究 以及其他几项研究 [2–4] 表明，最先进的模型生成的代码中至少 40% 含有一个或多个安全问题。类似的问题也影响 AI 编码代理。原因之一是这些模型在其上下文中往往缺乏足够的特定于库的安全知识。它们可能不知道哪些配置是不安全的、需要进行哪些验证步骤，或者库版本之间哪些安全相关行为发生了变化。AI Code Security Cards 为开源库提供实用的、版本特定的安全指导。例如，Django 安全卡可以指导 AI 代理如何安全地实现身份验证和授权。使用这些卡的最简单方法是安装代码库中提供的 AI 技能（也可在集成页面查看：https://securitycards.rewarelabs.com/integration/ ）。你也可以下载它们，并直接添加到 AI 代理的规则或指令中。我们非常乐意听到你的反馈，特别是这些卡在你的工作流中最有用之处、我们接下来应该支持哪些库，以及你是否遇到过由缺失上下文引起的类似安全问题。
网站：https://securitycards.rewarelabs.com/ GitHub 仓库：https://github.com/Reware-Labs/securitycards 参考文献 Hajipour, Hossein, 等. "CodeLMSec Benchmark: Systematically Evaluating and Finding Security Vulnerabilities in Black-Box Code Language Models." 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), IEEE, 2024, pp. 684–709. https://doi.org/10.1109/SaTML59370.2024.00040 .Pearce, Hammond, 等. "Asleep at the Keyboard?Assessing the Security of GitHub Copilot's Code Contributions." Communications of the ACM, vol. 68, no. 2, 2025, pp. 96–105. https://doi.org/10.1145/3610721 .Vero, Mark, 等. "BaxBench: Can LLMs Generate Correct and Secure Backends?
" arXiv, 2025, https://doi.org/10.48550/arXiv.2502.11844 . von Arx, Tobias, 等. "AutoBaxBuilder: Bootstrapping Code Security Benchmarking." arXiv, 2025, https://doi.org/10.48550/arXiv.2512.21132 .
译文由上游机器翻译生成，可能有误；判断请以英文原文为准。
英文原文（来源本站未改写）
Hi HN, TL;DR: AI Code Security Cards give coding agents library- and version-specific guidance to generate safer code.AI coding agents can generate working code, but they often lack library- and version-specific security knowledge.We've developed AI Code Security Cards, an open-source security knowledge layer, to provide that missing context.The project is related to my PhD, in which I focused on the security of LLM-generated code.During my research, I studied how code generation models behave, how they introduce security issues, and how we can guide them toward generating safer code.
My research and several other studies [2–4] show that at least 40% of code generated by state-of-the-art models contains one or more security issues.Similar problems also affect AI coding agents.One reason is that these models often lack sufficient library-specific security knowledge in their context.They may not know which configurations are unsafe, which validation steps are required, or what security-related behavior has changed between library versions.AI Code Security Cards provide practical, version-specific security guidance for open-source libraries.For example, the Django security cards can guide an AI agent on how to implement authentication and authorization securely.
The easiest way to use the cards is to install the AI skill provided in the repository (And in the integration page: https://securitycards.rewarelabs.com/integration/ ).You can also download them and add them directly to your AI agent’s rules or instructions.We’d be glad to hear your feedback, especially on where these cards would be most useful in your workflow, which libraries we should support next, and whether you’ve encountered similar security issues caused by missing context.
Website: https://securitycards.rewarelabs.com/ GitHub Repository: https://github.com/Reware-Labs/securitycards References Hajipour, Hossein, et al. “CodeLMSec Benchmark: Systematically Evaluating and Finding Security Vulnerabilities in Black-Box Code Language Models.” 2024 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), IEEE, 2024, pp. 684–709. https://doi.org/10.1109/SaTML59370.2024.00040 .Pearce, Hammond, et al. “Asleep at the Keyboard?Assessing the Security of GitHub Copilot’s Code Contributions.” Communications of the ACM, vol. 68, no. 2, 2025, pp. 96–105. https://doi.org/10.1145/3610721 .Vero, Mark, et al. “BaxBench: Can LLMs Generate Correct and Secure Backends?
” arXiv, 2025, https://doi.org/10.48550/arXiv.2502.11844 . von Arx, Tobias, et al. “AutoBaxBuilder: Bootstrapping Code Security Benchmarking.” arXiv, 2025, https://doi.org/10.48550/arXiv.2512.21132 .
这条还缺什么证据？
下面每条都由本条已有字段推出（等级、理由、商业模式、来源次数、是否演示）， 本站不生成推测性结论；通用验证方法放在方法论页。
- 可核验的收入或付费证据查官网定价页与付费口径；第三方数据源（如 GetLatka）只作旁证，需标注来源与时点。
- 商业模式未定确认按席位／按用量／授权还是开源托管版收费；开源项目另查 LICENSE 与是否存在付费版。
- 只有单一来源找一手站点或其他渠道是否重复出现同一产品；社区热帖数量不等于商业进展。
通用验证清单（谁有这个问题／谁愿意付费／一个人能交付哪一小步）见我们的筛选方法。