A quick reaction is that there's almost 2 different intents that need to be considered here:
- We want to build a business opportunity around auditing.
- We want to reduce the amount of insecure Sugabase apps.
They align somewhat but decisions may vary based on your lens when deciding how much weight to put for watch.
- IANAL, I assume you can or have assesed legal considerations around passive/active/automated scanning of this nature.
- In a direct world you could communitate the fix automatically to the right target for all your finds and track whether they fix the issue (audit periodically at a non spammy/cost inducing frequency)?
- In the general sense I'd try to estimate where I think the error manifests itself to attempt different solutions and find ways to measure those, where am I fixing the problem?
- LLM generated code: benchmark and evals to measure which popular programmatic LLMs recommend the right approach.
- Community recommendations: Make your case within the community to modify the appropriate tutorials.
- Is there something in the core tools (I don't really know Supabase) that would make it less likely for a developer following an outdated or malicious tutorial to do the insecure thing?
Security is always a fun problem to think about once you start thinking about it from an economics lens of rational actors with limited knowledge and varying incentives.
- We want to build a business opportunity around auditing.
- We want to reduce the amount of insecure Sugabase apps.
They align somewhat but decisions may vary based on your lens when deciding how much weight to put for watch.
- IANAL, I assume you can or have assesed legal considerations around passive/active/automated scanning of this nature.
- In a direct world you could communitate the fix automatically to the right target for all your finds and track whether they fix the issue (audit periodically at a non spammy/cost inducing frequency)?
- In the general sense I'd try to estimate where I think the error manifests itself to attempt different solutions and find ways to measure those, where am I fixing the problem?
- Is there something in the core tools (I don't really know Supabase) that would make it less likely for a developer following an outdated or malicious tutorial to do the insecure thing?Security is always a fun problem to think about once you start thinking about it from an economics lens of rational actors with limited knowledge and varying incentives.