Welcome to Software Development on Codidact!
Will you help us build our independent community of developers helping developers? We're small and trying to grow. We welcome questions about all aspects of software development, from design to code to QA and more. Got questions? Got answers? Got code you'd like someone to review? Please join us.
Comments on How do websites built by website builders defend security threats or follow secure coding?
Post
How do websites built by website builders defend security threats or follow secure coding?
There are SaaS providers for building and hosting websites made with WYSIWYG and LLM-prompt website builders, such as WordPress.com, Webflow, etc. I guess these services should be secure-by-default and secure-by-design, e.g. the builders should be guided to generate code to follow secure coding in JavaScript, and the hosting providers should provide automated vulnerability detection. However, I'm not sure if the generated code can effectively defend against security threats or likely attackers.
In my understanding, most components are merely HTML snippets, so they are bullet-proof. Dynamic components like routing, login, payment or APIs to third-party services can be made secure-by-default and secure-by-design. So a toy made from secured lego bricks should be secured as well? I wonder if the security decreases when LLMs are involved, because at the end of the day they can introduce new code that is not provided by the builders?
And what certifications would be relevant on this? For example, the security page of Webflow has information about the product security (Webflow itself), with various certifications. There are also places where they say the websites built by their builder are secured, but I'm unable to see how they defend security threats (broken access control, injection, etc.) or follow secure coding (cross-site scripting, inline script, etc.).
1 comment thread