kaiqi-liang / llm-research

Secure Coding with LLMs

Seting up the Environment

Add your openAI API key in an environment variable and install all the dependencies.

export OPENAI_API_KEY=openai-api-key
pip install -r requirements

Static Analysis Tools

Flawfinder

For C/C++, already installed with pip.

Bandit

For Python, already installed with pip.

Spotbugs

For Java, download the zip file from the official manual and unzip it.

Bearer

Most of its security rules are for JavaScript/TypeScript, run the following command or see the instructions for other install method.

curl -sfL https://raw.githubusercontent.com/Bearer/bearer/main/contrib/install.sh | sh

Running the Pipeline

python pipeline.py

The first step of the pipeline is to enter a filename that contains the vulnerable code that you would like to be fixed.

The file that contains vulnerable code:

The next user input is contextual code.

Do you have any contextual code (y/n)

If you enter y you will then be prompted to enter the contextual code.

The code in plaintext:

The last thing you have to input is the consequences of insecure code.

What are the consequences if the code is not secure?