一个关于技术、代码和一切之间事情的个人博客。
文章
3
Every enterprise that experimented with copilots in 2024 is now deploying agents that *act* — reading mailboxes, creating tickets, running remediation scripts, and chaining calls across SaaS APIs with minimal human supervision.
Prompt injection sits at the top of the OWASP Top 10 for LLM Applications for a reason: it is cheap to attempt, hard to fully prevent, and the blast radius keeps growing as we wire models into tools, email,…
Generative AI has done to the enterprise what SaaS did a decade ago: it is being adopted faster than security teams can inventory it.
A deep dive into the world's major AI governance frameworks — NIST AI RMF, ISO/IEC 42001, the EU AI Act, OECD principles, and China's regulatory system — covering their structure, binding force, and how enterprises should combine them in practice.
以 NIST AI RMF 为核心，系统梳理全球主要 AI 治理框架（ISO/IEC 42001、欧盟 AI 法、OECD 原则、中国监管体系等）的结构、约束力与相互关系，并给出企业选型与落地实施建议。
结合真实的前端项目安全加固案例，探讨开源软件中容易被忽视的安全盲点，包括安全响应头配置、robots.txt信息泄露、环境变量管理、前端密钥暴露、服务端代理架构以及HTTP方法限制等六个维度，提供可落地的防护建议。
A practical tour of the four caching layers in a modern web stack — HTTP cache headers, CDN edge caching, application-level Redis caching, and database buffers — with invalidation strategies that keep data fresh.
从零开始掌握Supabase，深入了解PostgreSQL数据库、RLS安全策略、实时订阅和Edge Functions，构建安全可靠的现代全栈应用。