Loading...
Loading...
Compare original and translation side by side
| Issue | Severity | Solution |
|---|---|---|
| Trusting LLM output without validation | critical | # Always validate output: |
| User input directly in prompts without sanitization | critical | # Defense layers: |
| Stuffing too much into context window | high | # Calculate tokens before sending: |
| Waiting for complete response before showing anything | high | # Stream responses: |
| Not monitoring LLM API costs | high | # Track per-request: |
| App breaks when LLM API fails | high | # Defense in depth: |
| Not validating facts from LLM responses | critical | # For factual claims: |
| Making LLM calls in synchronous request handlers | high | # Async patterns: |
| 问题 | 严重程度 | 解决方案 |
|---|---|---|
| 未验证就信任LLM输出 | 严重 | # 始终验证输出: |
| 用户输入直接放入提示而未做清理 | 严重 | # 多层防御: |
| 向上下文窗口中塞入过多内容 | 高 | # 发送前计算token数量: |
| 等待完整响应后再展示内容 | 高 | # 流式传输响应: |
| 未监控LLM API成本 | 高 | # 按请求跟踪: |
| LLM API故障时应用崩溃 | 高 | # 深度防御: |
| 未验证LLM响应中的事实 | 严重 | # 对于事实性声明: |
| 在同步请求处理器中调用LLM | 高 | # 异步模式: |