一个关于技术、代码和一切之间事情的个人博客。
文章
6
On August 2, 2025, the EU AI Act's obligations for general-purpose AI (GPAI) models became applicable — six months after the Article 5 prohibitions took effect, and roughly a year before the high-risk regime lands in August 2026.
Every enterprise that experimented with copilots in 2024 is now deploying agents that *act* — reading mailboxes, creating tickets, running remediation scripts, and chaining calls across SaaS APIs with minimal human supervision.
You would not ship a web application without running OWASP ZAP against it. Yet AI features — chatbots, copilots, agentic workflows wired into production data — routinely go live without a single adversarial probe.
Microsoft 365 Copilot is not a search engine with a chat interface bolted on — it is an amplifier for whatever permission posture your tenant already has.
Prompt injection sits at the top of the OWASP Top 10 for LLM Applications for a reason: it is cheap to attempt, hard to fully prevent, and the blast radius keeps growing as we wire models into tools, email,…
Generative AI has done to the enterprise what SaaS did a decade ago: it is being adopted faster than security teams can inventory it.
A deep dive into the world's major AI governance frameworks — NIST AI RMF, ISO/IEC 42001, the EU AI Act, OECD principles, and China's regulatory system — covering their structure, binding force, and how enterprises should combine them in practice.
以 NIST AI RMF 为核心，系统梳理全球主要 AI 治理框架（ISO/IEC 42001、欧盟 AI 法、OECD 原则、中国监管体系等）的结构、约束力与相互关系，并给出企业选型与落地实施建议。
结合真实的前端项目安全加固案例，探讨开源软件中容易被忽视的安全盲点，包括安全响应头配置、robots.txt信息泄露、环境变量管理、前端密钥暴露、服务端代理架构以及HTTP方法限制等六个维度，提供可落地的防护建议。
A practical tour of the four caching layers in a modern web stack — HTTP cache headers, CDN edge caching, application-level Redis caching, and database buffers — with invalidation strategies that keep data fresh.
从零开始掌握Supabase，深入了解PostgreSQL数据库、RLS安全策略、实时订阅和Edge Functions，构建安全可靠的现代全栈应用。