AI 编辑器为何总写出不安全代码 一篇来自 SafeWeave 博客的分析文章指出,AI 编程助手(如 Cursor)生成不安全代码的根源,并非模型缺乏安全知识,而是其训练数据主要来自教程和问答网站,而非经过安全审查的生产代码。这些教学代码为了可读性,通常会刻意省略安全控制。 作者用一个实验验证了这一点:让 Cursor 为一个 Express API 添加搜索端点,它生成了存在 SQL 注入漏洞的代码;但把这段代码原样粘贴回去询问是否安全,模型却能准确指出问题并给出参数化查询的修复方案。这说明模型"知道"安全写法,但生成代码时却走了另一条路径。 教程代码在传播过程中,作者附带的"生产环境请勿这样做"等警告往往被丢弃,只有代码片段被大量复制。这导致训练语料中不安全代码模式占绝对多数,而安全警告却很少见。提示模型"写安全代码"只能影响明确提到的模式,无法覆盖所有细节,且随着对话变长,默认行为会重新占据主导。 文章建议,不要…

Channel
GitHub开源观察|开源项目·热门仓库·开发者
@GitHubTrendingHub
On this record: Growth · Engagement · Posts · Citations · Handles named that no longer answer · Cite this entry
1,312subscribers
+16 since we began measuring on 6 August 2026
Risers and fallers across the register · movement among entries of 1,000–3,162.
Register entry
| Telegram ID | -1003793054106 |
|---|---|
| Type | Channel |
| Username | @GitHubTrendingHub |
| Created | Between 1 February 2026 and 30 June 2026— estimated from Telegram’s id allocation, not measured. How this range is calculated. |
| First recorded | 6 August 2026 |
| Last confirmed live | 12 August 2026 |
| Measurements held | 5 |
| Confirmed unchanged | 1 time, most recently 12 August 2026 |
| On Telegram | t.me/GitHubTrendingHub |
Growth
| Measured (UTC) | Subscribers | Change |
|---|---|---|
| 12 Aug 2026, 17:12 | 1,312 | +4 |
| 9 Aug 2026, 23:35 | 1,308 | +11 |
| 7 Aug 2026, 00:41 | 1,297 | +1 |
| 6 Aug 2026, 20:01 | 1,296 | no change |
| 6 Aug 2026, 19:52 | 1,296 | first reading |
Engagement
18 posts held, back to 5 August 2026 — the reader has not yet reached the start of this channel’s public history, so older posts may sit further back, unread. Read across 1 pageof Telegram’s post history, 20 posts per page.
- ERR · 30 days
- 0.597%
- avg views ÷ 1,312 subscribers
- Avg views / post
- 7.8
- 18 posts measured
- Reaction rate
- —
- this channel exposes no reaction counts
- Posts in window
- 18
- of 18 held
ERR is average views per post over the last 30 days divided by subscribers, the definition TGStat uses, so this figure is comparable with the one you will see elsewhere. It falls structurally as a channel grows: a high ERR on a small channel and a low one on a large channel describe reach mathematics, not quality. We publish the figure and the sample it came from and pass no verdict on it.
ER is defined industry-wide as (forwards + reactions + comments) ÷ views— note the denominator is views, not subscribers. Telegram’s public web preview carries views and reactions but not forward or comment counts, so the reaction rate above is the reactions term only and is therefore a floor: the true ER for this channel is higher by an amount we have not measured and will not estimate.
| Window | Rolling 30 days · latest post in window 6 August 2026 |
|---|---|
| Posts held | 18 (5 August 2026 – 6 August 2026) |
| Views total | 141 |
| Reactions total | — |
| Forwards / comments | not exposed by the public surface — not measured, not estimated |
| Readings taken | 6 Aug 2026, 20:01 UTC |
Views are a single reading per post, taken at the time above. A post published in the last day or two is still accumulating views, which pulls the 30-day average down slightly. That is a property of the standard definition rather than a fault in it, so we keep the definition rather than “correcting” the number into something nobody can reproduce.
Precision. Telegram publishes view counts on its public widget in short form — 8.12K, 3.7M — so any reading at or above 1,000 reaches us rounded to three significant figures, and only counts below 1,000 are exact. Averages and rates derived from them are shown to the same precision rather than to the unit: a figure like 3,701,250 would assert digits nobody measured.
Reaction counts are published per emoji and rounded the same way, so a total below 1,000 is exact and a larger one is a sum that may carry a rounded component from each emoji above 1,000. Because it is a sum, it does not look rounded — read a large reaction total as three significant figures per contributing emoji rather than as the figure it prints.
Recent posts
FastMCP 类型检查漏洞:mypy 用户被坑,CI 却全绿 FastMCP(27k stars)的 Context.elicit 方法声明了六个 @overload 存根,但每个存根的函数体只有 ...,说明文字被放在了函数体之后。这导致这些字符串不是真正的 docstring,而是类体中的裸表达式语句,会中断 mypy 的 overload 链。 mypy 只能识别六个重载中的第一个——恰好是库自身标记为弃用的 response_type: None 形式。pyright 和 ty 不受影响,而 FastMCP 自己的 CI 用的正是 ty,所以问题被顺利发布。作者尝试了五种调用写法,在 mypy 下全部失败,pyright 下全部通过。 更严重的是,response_type=None 会编译成空 JSON schema,意味着自动接受的客户端产生的数据与人工点击批准在网络上无法区分。作者此前已用真实探测证明,一个…
📢 优质频道推荐 1. 狮城日报(新加坡新闻) 2. 我在迪拜 · 阿联酋资讯 3. DeFi & Yield — 英文频道·DeFi 质押与收益策略 4. 商业科技评论|商业·科技公司·观察 5. 环球体育|足球·NBA·赛事速递 6. 命理玄学馆|易经·八字·黄历·星座运势 7. Web3链上职位|区块链招聘·远程·Crypto Jobs 8. Cripto en Español — 西班牙语频道·加密货币行情与分析 9. 软件工具库|软件推荐·效率工具·实用App 10. 德国新闻(柏林 慕尼黑) 想让你的频道出现在这里?私聊 @pindaotuijianbot 提交申请(免费)
「规范驱动」AI 协作开发体系实践 存量项目增量开发中,AI 常出现理解偏差、执行不稳、需频繁纠正等问题。作者自建「OpenSpec 规范层 + AI Workflows 执行层」体系,通过「规范 + 技能 + 钩子」机制,对 AI 的理解、执行和校验进行系统化约束与增强,提升开发协作的准确率与稳定性。 这套方法适合在既有代码库上持续迭代、并希望减少人工干预的团队。它把 AI 从「需要反复纠正的实习生」逐步培养成更可靠的协作者,核心思路是用规范约束理解、用技能固化流程、用钩子衔接校验。 体系分为三层:规范层负责定义任务目标与验收标准,执行层通过 AI Workflows 将规范转化为具体操作步骤,钩子则在关键节点自动触发校验,确保输出符合预期。 作者强调,这套体系的价值在于将隐性经验显性化,让 AI 在复杂存量代码中也能保持稳定的表现,减少来回沟通与返工成本。 对受困于 AI 生成质量不稳定的开发者而言,这套「规范驱动」…
Forem API 自动化踩坑:七个文档没告诉你的坑 一位 AI 代理完全通过 Forem API 在 dev.to 上发布了九篇文章,全程未打开编辑器。大部分功能与文档一致,但这七处不一致让它白忙了一上午,且每个问题都已复现。 front matter 里的 published: true 无效。发送带该字段的 Markdown,接口返回 201,文章仍是草稿。发布状态必须放在 JSON 的 article 对象上,front matter 只解析标题、标签、封面等。建议加个守卫:检查响应中的 published 字段,为 false 就再发一次 PUT。 更新时 front matter 优先级高于 API。直接 PUT tags 字段返回 200,但标签纹丝不动。凡是用 front matter 创建的文章,标题、标签、封面、系列、描述都以 front matter 为准。要改只能先取回 body_markdown,…
张一鸣三次否决蒸馏,字节为何坚持自研 2026年7月,张一鸣在字节Seed团队全员会上拍板:禁止蒸馏任何外部模型,无论闭源还是开放权重。The Information 8月5日报道此事,将其动机归结为对TikTok命运的担忧——怕蒸馏美国前沿模型招致华盛顿报复。但知情人士透露,TikTok在此决策中的权重"几乎为零"。 张一鸣给出的理由是"为了实现长远目标"。这并非他首次否决蒸馏路线,此前已有两次类似表态。三次否决背后,是字节对自研基座模型的坚持:蒸馏虽能快速拉近与前沿模型的差距,却会让团队丧失底层创新能力,长期依赖外部技术底座。 对关注大模型竞争的开发者而言,这条信息的关键在于:头部玩家正在用行动划定技术路线边界。蒸馏作为行业常见的追赶手段,在字节这里被明确叫停,意味着其后续模型迭代将完全依赖自研能力,也侧面反映国内大模型竞争正从"快速对齐"转向"底层创新"的硬碰硬阶段。 #GitHub #开源 #张一鸣 #字节跳动 …
DeepSeek 宣布 API 将大幅涨价 DeepSeek 开放平台 8 月 6 日发布官方通知,计划近期整体上调 API 服务定价,预计涨幅较大,具体方案以正式通知为准。 目前 DeepSeek 官方 API 价格,尤其是 v4-flash 定价极低,在主流模型中性价比突出。大量用户请求涌入也导致官方服务出现不稳定。 对依赖 DeepSeek API 的开发者而言,建议关注后续正式调价方案,合理安排使用计划与成本预算。 #GitHub #开源 #DeepSeek #API #大模型 #AI @GitHubTrendingHub
字节发布 SeedRealtime 音视频全双工大模型 字节跳动 Seed 宣布正式推出原生音视频全双工大模型 SeedRealtime。该模型采用统一架构,原生融合音频、视频与文本,可在连续的多模态信息流上实时交互,实现“边看、边听、边说”的体验。目前 SeedRealtime 已在豆包 App 全量上线。 官方称其实现三项核心突破:音视频联合理解,原生支持声音、画面与时序信息的协同处理;全双工实时交互,支持低延迟的流式对话;统一架构设计,以单一模型同时处理多模态输入输出。 对开发者而言,这意味着多模态实时交互能力从实验走向可用,可直接在豆包生态中体验,也为后续开放 API 或开源预留了想象空间。 GitHub #GitHub #开源 #字节跳动 #SeedRealtime #多模态大模型 #音视频交互 #豆包 @GitHubTrendingHub
腾讯开源 UCL-MPComm 通信库 腾讯网平团队宣布开源 UCL-MPComm 通信库,并作为传输引擎接入 Mooncake TENT。该库针对 AI 内存池化场景的数据传输需求做了深度优化,支持数据中心内大规模计算节点间多种内存类型的高性能通信。 接入 Mooncake TENT 后,零拷贝传输性能提升 30%,非零拷贝传输性能最高提升 5 倍。对做 AI 基础设施、分布式训练和内存池化方向的同学来说,这套方案直接关系到跨节点数据搬运的效率,值得关注。 GitHub #GitHub #开源 #腾讯 #UCLMPComm #MooncakeTENT #通信库 #AI基础设施 #内存池化 @GitHubTrendingHub
AI 时代 Web 工程:性能、成本与隐私的平衡 现代 Web 应用已从静态页面演变为浏览器、边缘与云端边界模糊的分布式系统。工程挑战早已超出 UI 层面,转向数据管道、推理逻辑与隐私架构。文章提出性能、成本、隐私三者可兼得的新工程范式,核心是让 AI 推理尽可能靠近用户。 三大架构模式 客户端推理通过 WebAssembly 与 WebGPU 在浏览器内运行模型,消除网络延迟、降低服务器成本,数据不出设备。边缘计算(Cloudflare Workers、Deno Deploy 等)适合复杂推理场景,配合 KV 缓存可大幅减少回源。混合编排管道则按任务复杂度在本地、边缘与中心云之间动态调度。 关键实践 模型量化(INT8)可显著减小体积、提升速度;Web Workers 避免推理阻塞主线程;二进制序列化(Protocol Buffers 等)替代 JSON 提升高频数据传输效率。隐私方面,PII 剥离、差分隐私与本地优…
Visual Studio Code 1.132 发布 Visual Studio Code 1.132 版本现已发布。本次更新聚焦 AI 辅助开发体验,在集成浏览器中引入了元素级反馈、多语言语音输入、侧边聊天功能,并在混合 Markdown 编辑器中加入了 Markdown diffs 功能。 对使用 Copilot 等 AI 编程工具的开发者来说,这次更新值得关注。集成浏览器新增的注释功能,可以直接对特定网页元素添加注释,向 agents 提供精准反馈,省去来回切换窗口描述问题的麻烦。多语言语音输入则利用设备端模型,根据你的语言偏好或自动检测进行语音转写,无需联网即可使用。 侧边聊天功能让对话面板可以固定在侧边栏,方便在编辑代码时随时调用 AI 助手。混合 Markdown 编辑器新增的 Markdown diffs 功能,则让文档变更对比更加直观。 本次为常规功能更新,不涉及破坏性变更,现有扩展和配置均可正常使用。…
Syncthing 2.1.3 发布,修复符号链接与扫描问题 Syncthing 是一款免费开源的连续文件同步工具,可在你的多台设备间直接、安全且私密地同步文件与文件夹,数据不经第三方服务器中转。 本次 2.1.3 为维护性小版本,主要修复两类问题:一是允许加载符号链接指向位置的忽略规则,二是避免扫描文件时出现的异常。现有用户升级即可获得更稳定的同步体验。 GitHub #GitHub #开源 #Syncthing #文件同步 #隐私工具 @GitHubTrendingHub
Showing the 12 most recent of 18 posts we hold for @GitHubTrendingHub. View and reaction counts are the latest single reading for each post, not a live figure, and a recent post is still accumulating both. A view count marked ≈ was rounded by Telegram before we ever saw it — t.me prints views in full below 1,000 and to three significant figures above, so ≈1,200,000 means somewhere between 1,150,000 and 1,249,999. Unmarked counts are exact. Text is reproduced from the public post preview and truncated for length.
Citation-graph rank
Citation-graph rank — 108,665 of 1,169,250entries in the measured graph. A weighted position computed from the forward and mention edges below — republished posts weigh more than named mentions — and recomputed periodically, over the whole graph. Published only as this ordinal position, never as a score: a position is a fact, and a score printed beside one channel’s name would read as a verdict this register does not make. The two counts beneath stay separate for the same reason mentions are never summed with forwards anywhere else on this page — a named-by count costs nothing to manufacture. The top 100 by this measure, or how it is computed.
Mentions
Named by 37 registered channels — every channel on the register whose own posts have named this one, by its current username or any other username it currently holds, merged from two separately captured readings of the same fact so a namer caught by only one of them is not missed and a namer both caught is not counted twice. A username this channel has since dropped is not matched — that handle may belong to someone else now, and crediting today’s namer to yesterday’s owner would misattribute it. The 24 listed below are the most frequent namers; the rest are counted above but not each listed.
Named by
Channels on the register whose posts name this channel's handle.
@AIPaperCN · 213 posts开发者工具箱|编程·开发工具·资源
@DevToolboxHub · 1,2143 postsGRAM生态观察|TON链·钱包·代币动态
@GramTonWatch · 193 postsiOS 侧载精选|巨魔·免签·解锁应用
@iOSSideloadCN · 213 posts安全内参|漏洞·渗透·攻防
@SecTalkCN · 223 postsDeFi & Yield|DeFi·Staking·Yield Farming
@DeFiYieldChannel · 1,2062 postsAI前沿情报|AI新闻·大模型·ChatGPT
@AIDailyCN · 1,1951 post商业科技评论|商业·科技公司·观察
@BizTechCN · 811 post加密货币日报|币圈·行情·快讯
@CryptoDailyCN · 1,0561 postCrypto Daily|Bitcoin·Ethereum·News
@CryptoDailyWireCN · 1,2081 post加密挖矿观察|矿工·算力·矿机·矿池
@CryptoMineCN · 191 post网络安全·黑客攻防|渗透·CTF·安全资讯
@CyberSecWatch · 1,1911 post深度好文|每日涨姿势
@DeepReadCN · 211 post效率工具与数字生活|效率工具·数字生活·App推荐
@DigitalLifeToolsCN · 1,1941 post游戏日报|新作·热点·硬核
@GameDailyCN · 9841 post房地产观察|楼市·房价·地产政策
@HouseWatchCN · 1,0591 post每日沙雕图|梗图·段子·乐子
@MemeDailyCN · 251 post伊朗·中东观察
@MideastWatchCN · 1,2271 post纽约时报中文|国际时政·深度·评论
@NYTChineseDaily · 2131 post新西兰生活报
@NZChineseHub · 2081 post远程项目库|兼职·外包·接单
@RemoteGigsHubCN · 1,2151 post路透中文|国际·财经·环球快讯
@ReutersZhongwen · 1,1891 post软件工具库|软件推荐·效率工具·实用App
@SoftwareToolboxCN · 1,2011 postWeb3技术前沿|区块链·智能合约·协议
@Web3TechTrend · 1,1851 post
Names
Channels on the register whose handles appear in this channel's posts.
@AIAutoFrontline · 1,2231 post商业科技评论|商业·科技公司·观察
@BizTechCN · 811 post职业规划大师|求职·面试·职场晋升
@CareerPathCN · 1,1681 post中文社会热点|社会·民生·舆情
@CNSocialFocus · 1,1821 postCripto en Español|Bitcoin·Criptomonedas·Análisis
@CriptoDiarioES · 1,3371 postCrypto Farsi|ارز دیجیتال·بیتکوین·تحلیل
@CryptoFarsiDaily · 1,3071 post网络安全·黑客攻防|渗透·CTF·安全资讯
@CyberSecWatch · 1,1911 post深度好文|每日涨姿势
@DeepReadCN · 211 postDeFi & Yield|DeFi·Staking·Yield Farming
@DeFiYieldChannel · 1,2061 post开发者工具箱|编程·开发工具·资源
@DevToolboxHub · 1,2141 post效率工具与数字生活|效率工具·数字生活·App推荐
@DigitalLifeToolsCN · 1,1941 post我在迪拜 · 阿联酋资讯
@DubaiChineseHub · 1,1891 post游戏日报|新作·热点·硬核
@GameDailyCN · 9841 post德国新闻(柏林 慕尼黑)
@GermanyChineseHub · 1,2081 post独立开发与一人公司|独立开发·一人公司·出海
@IndieHackerCN · 1,2041 post每日沙雕图|梗图·段子·乐子
@MemeDailyCN · 251 post伊朗·中东观察
@MideastWatchCN · 1,2271 post狮城日报(新加坡新闻)
@SingaporeChineseCN · 1,3501 post软件工具库|软件推荐·效率工具·实用App
@SoftwareToolboxCN · 1,2011 post创业内参|创业·融资·商业模式
@StartupInsiderCN · 1,2061 post俄乌战争·前线战场视频🎥|战场实拍·前线·军情
@UAWarVideo · 1,1811 postWeb3链上职位|区块链招聘·远程·Crypto Jobs
@Web3JobsCN · 1,4461 post国际新闻|突发·快讯·环球
@WorldNewsFlashCN · 1,1801 post命理玄学馆|易经·八字·黄历·星座运势
@YijingDailyCN · 1,0641 post
A mention is a weaker signal than a forward and is counted separately for that reason — naming a channel is not republishing it, and a handle in a post body is easy to place deliberately. The post counts beside each row below are distinct posts in which the handle appeared, from posts we have read on both sides — the “Named by N registered channels” figure above is a different count, of distinct NAMING CHANNELS rather than posts, and is not the sum of the rows under it.
Handles this channel named that no longer answer
- Dead references
- 1
- handles named in this channel’s posts, vacant today
- Evidenced gone
- 0
- we ourselves saw one of these resolve, at some point
- Never seen alive
- 1
- vacant every time we have ever looked
@GitHubTrendingHub named 1 handle that resolve to nothing today. That is a fact about the reference, not necessarily a fact about the handle’s history — see the two groups below.
Most of these may never have existed as a live channel at all.A handle a channel names can be a typo, an aspirational name nobody registered, or a channel that was already gone before this one ever mentioned it. Unless a row below is marked evidenced, all we know is that it references a handle that is not a live channel today — not that anything “died”. How this is measured.
Never seen alive
References a handle that is not a live channel — we have no record it ever was one.
named in 1 post, 8 August 2026 – 8 August 2026
Cite this entry
A live page changes as we take new readings, so a citation should name the measurement it is based on, not just the URL. The line below cites the subscriber count as measured 12 August 2026 — this entry's latest reading, not the date you are reading this.
“GitHub开源观察|开源项目·热门仓库·开发者” (@GitHubTrendingHub), 1,312 subscribers as measured 12 August 2026. Telegram Register, tgregister.com/channel/GitHubTrendingHub.
Full measurement history, CC BY 4.0. Every reading this register holds for this entry, not just the latest one, as a dated, downloadable record: CSV · JSON. Free to use with attribution to tgregister.com. Each file carries its own generation timestamp, which is the figure to cite for exactly when the data was retrieved.