Grype
This vulnerability scanner is designed for container images and filesystems. It's easy to install and works with Syft, a powerful SBOM tool that analyzes container images and filesystems to generate detailed software bills of materials.
Prompt Engineering Demands Rigorous Evaluation
In the blog post “Prompt Engineering Requires Evaluation” on the Shostack + Associates website, the author argues that treating prompts for large language models (LLMs) merely as creative artefacts is insufficient. Engineering prompts properly demands structured evaluation frameworks — what the AI community calls “evals” — to test which prompt versions work better, with which models, and under which conditions. The post highlights that simply assuming a prompt is “good enough” creates risks when LLMs are integrated into production systems (e.g., for threat modeling). It advocates for measuring prompt performance, variation effects, and tool-chain dependencies (model, context, ancillary materials). Ultimately the message is: prompt engineering should borrow disciplined practices from software engineering (versioning, testing, benchmarking) rather than relying on informal experimentation. https://shostack.org/blog/prompt-enignieering-requires-evaluation/
Comments
Post a Comment