Conversation
kOaDT
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
While going through Module 15 I checked each external source. Three don't hold up. This PR fixes those.
The PyPI package
The Input Validation section recommended
llm-input-sanitizerby name. It's at 0.2.1, the author field is "Alex", and the GitHub repository it declares as its home page is gone: https://github.com/alexu8007/llm-input-sanitizerModule 10 of this curriculum teaches developers to verify the provenance of a dependency before pulling it in. Naming a pre-1.0 package with no reachable source repository five modules later undercuts that. I've replaced the recommendation with the point it was standing in for (filtering input isn't a trust boundary) and cited the OWASP LLM Prompt Injection Prevention Cheat Sheet, which makes the same argument and pairs filtering with least privilege, rate limiting and human approval for high-risk operations.
The ASVS reference
The same section linked the Annotated ASVS v4 on readthedocs. Modules 2, 3, 4 and 9 all cite ASVS 5.0.0, and that chapter was renumbered from V5 to V1 between the two versions, so the link text didn't match its target either. Switched to ASVS 5.0.0 V1 Encoding and Sanitization, in the same link format the other modules use.
"number 05 of the OWASP LLM Top 10"
Improper Output Handling was LLM05 in the 2025 edition. In the 2026 edition, published 4 August 2026, it's LLM10, and it now also covers insecure code produced by coding assistants. Fixed the rank and the link.
That one is the small end of a larger problem. 15.01 still lists all ten 2025 entries. I'll open an issue for that.