Philipp Schmid· @_philschmid · X·· 4 天前AI 评分69
AI 导读
Philipp Schmid 分享了一份针对 2026 年 10 月安全披露的只读环境排查提示词，用于检查代码仓库、容器和本地环境。该提示词涵盖供应链与密钥排查（如 LiteLLM 和 Railway 相关配置）、运行时与基础设施版本检查，以及直接与传递性依赖审计，最终要求以紧凑表格返回状态、组件、位置与修复命令。
正文 · 原文
Run a read-only check on this repo, its containers, and my local environment for the Oct 21-22, 2026 security disclosures (ask before editing files):- Supply-chain & secrets (scanners miss these):
- LiteLLM 1.107.0: check all Python lockfiles, Docker tags (
latest/1.107.0), and localsite-packages+/tmpforcook.pth,http://cook.py,litellm_init.pth,/tmp/.pc_once_*, or/tmp/remote_code_loader.lock. - Railway: check for
railway.*configs orRAILWAY_*CI vars and list every secret/API key/DB URL referenced so I can rotate them at the source provider. - Runtimes & infra: check local versions, base images, and IaC for PHP (<8.5.12 / 8.4.27 / 8.3.36 / 8.2.35), Node/Bun Brotli decoding, self-hosted GitLab (<19.5.1, CVE-2026-110264), and eMudhra CA stores (
uv <0.11.7,certifi <2026.10.20). - Direct & transitive deps: run available scanners (
osv-scanner,uvx pip-audit,npm/pnpm/bun audit,govulncheck ./...) and check lockfiles against https://github.com/advisories
Return a compact table: Status (ROTATE KEYS / PATCH / SAFE) | Component | Location | Exact Fix Command.
```
来源：Philipp Schmid · x.com