docs(10_Wiki): 위키 전체 재구성 — Topic_* 폴더를 4개 카테고리로 통합 + 대규모 중복 제거

Topic_Agent/Topic_Blog/Topics/Topics_Biz/Topics_Meeting/Topics_Rag의 마크다운 지식 문서를 Topic_General/Topic_Programming/Topic_Graphic/Topic_Business 4개 카테고리로 재분류. - 중복 제거: frontmatter의 status:duplicate/merged + duplicate_of/redirect_to 필드로 자기 자신을 중복으로 선언한 리다이렉트 stub 1032개 제거, 완전 동일 내용 파일 472개 제거, 동일 파일명·다른 내용 충돌 시 더 큰(완전한) 버전만 유지(162개 제거) — 총 1639개 중복 제거. - 분류: 폴더 단위로 명확한 항목(AI_and_ML/Coding/Architecture 등 → Programming, Comfyui/Visual_Effects → Graphic, Topics_Biz/Topics_Meeting/사업 등 → Business, Poetic_Blog_Writing/창의성/Game_Design 등 → General)은 폴더 우선순위로, 나머지 혼재 폴더(Topic_Agent/Topic_Blog/Topics 루트/Thinking & Reasoning/Other/UI_UX_Assets)는 title/tags 키워드 스코어링으로 파일 단위 분류(불명확한 경우 General로 폴백). 원본 폴더명은 "From_*" 서브폴더로 보존해 추적 가능성 유지. - 최종 배치: Programming 2784 / General 1608 / Graphic 285 / Business 249 = 4926개 문서. - 에이전트 운영 상태(.astra/.agent/.obsidian/sessions/memory/_company/docs/lessons/_shared/src)는 지식 콘텐츠가 아니므로 재분류 대상에서 제외하고 원위치 유지. - Topics/Topic_email(상위 보호 폴더 Topic_email과 파일명 100% 중복) 삭제 — 보호 폴더 자체는 미변경. - 완전히 비게 된 Topic_Agent/Topic_Blog/Topics_Biz/Topics_Rag 폴더 제거.
2026-07-05 00:33:48 +09:00
parent 1cfd3bbb56
commit 9148c358d0
6455 changed files with 1 additions and 86875 deletions
@@ -0,0 +1,290 @@
+---
+id: wiki-2026-0508-ai-코드-리뷰-및-보안-취약점-점검-devsecops
+title: AI Code Review + DevSecOps
+category: 10_Wiki/Topics
+status: verified
+canonical_id: self
+aliases: [DevSecOps with AI, AI security review, hybrid code review, shift-left security]
+duplicate_of: none
+source_trust_level: B
+confidence_score: 0.85
+verification_status: conceptual
+tags: [devsecops, ai-code-review, sast, security, shift-left, owasp, ci-cd]
+raw_sources: []
+last_reinforced: 2026-05-09
+github_commit: pending
+inferred_by: Claude Opus 4.7 (manual cleanup 2026-05-09)
+---
+
+# AI Code Review + DevSecOps
+
+## 📌 한 줄 통찰
+> **Shift-left security**. 매 SDLC 의 early 의 SAST + AI review + human. 매 mechanical 의 AI, 매 architectural 의 human.
+
+## 📖 핵심
+
+### Hybrid model
+- **AI**: pattern matching, syntax, known CVE.
+- **Human**: business logic, architecture, novel attack.
+- **Together**: 매 layer 의 different defect class.
+
+### Shift-left phases
+
+#### IDE (real-time)
+- 매 keystroke 의 lint / type.
+- Cursor / Copilot 의 inline.
+
+#### Pre-commit (local)
+- Husky + lint-staged.
+- 매 dev 의 first defense.
+
+#### PR (automated)
+- CodeRabbit / Greptile.
+- Snyk / Sonar SAST.
+- 매 dependency check.
+
+#### CI deep
+- Container scan.
+- Dependency vulnerability.
+- License check.
+
+#### Pre-deploy
+- Integration security test.
+- DAST (runtime).
+
+#### Production
+- WAF.
+- RASP (runtime application self-protection).
+- 매 alert / incident.
+
+### 매 OWASP Top 10 (2021)
+1. Broken Access Control.
+2. Cryptographic Failures.
+3. Injection (SQL, XSS, Command).
+4. Insecure Design.
+5. Security Misconfiguration.
+6. Vulnerable Components.
+7. Authentication Failures.
+8. Software / Data Integrity.
+9. Logging / Monitoring Failures.
+10. SSRF.
+
+→ 매 SAST 의 mostly cover. 매 #4 (insecure design) = human.
+
+### Tool stack (2026)
+
+#### IDE
+- Cursor (AI-native).
+- Snyk Code IDE plugin.
+- GitHub Copilot Chat.
+
+#### CI / PR
+- CodeRabbit (LLM review).
+- Snyk Code (SAST).
+- Sonar (quality + security).
+- Semgrep (custom pattern).
+- GitHub Advanced Security (CodeQL).
+
+#### Container
+- Trivy (image scan).
+- Snyk Container.
+- Docker Scout.
+
+#### Dependency
+- Dependabot.
+- Renovate.
+- Snyk Open Source.
+
+#### Secret
+- TruffleHog.
+- GitGuardian.
+- 매 pre-commit hook.
+
+#### DAST
+- OWASP ZAP.
+- Burp Suite.
+
+### 매 quality gate
+
+#### PR gate
+- 매 high severity 의 fail.
+- 매 critical CVE 의 block.
+- 매 secret 의 detection 의 block.
+
+#### Pre-deploy gate
+- 매 manual approve (high-risk).
+- 매 automated test 의 pass.
+
+### Compliance
+
+#### SOC 2
+- 매 audit log.
+- 매 access control.
+- 매 incident response.
+
+#### PCI DSS (payment)
+- 매 encryption.
+- 매 segmentation.
+
+#### GDPR (privacy)
+- 매 data minimization.
+- 매 consent.
+
+#### HIPAA (health)
+- 매 PHI handling.
+
+### Vibe coding 의 specific risk
+- 매 AI-generated code 의 security blind spot.
+- 매 prompt injection 의 reproduce.
+- 매 hardcoded secret (LLM 의 example).
+- 매 outdated security practice.
+
+## 💻 Code
+
+### CI workflow
+```yaml
+# .github/workflows/devsecops.yml
+on: [pull_request, push]
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with: { fetch-depth: 0 }
+      
+      # Secret scan
+      - uses: trufflesecurity/trufflehog@main
+        with:
+          path: ./
+          base: ${{ github.event.repository.default_branch }}
+      
+      # SAST
+      - uses: snyk/actions/setup@master
+      - run: snyk code test --severity-threshold=high
+      
+      # Dependency
+      - run: snyk test --severity-threshold=high
+      
+      # Container
+      - run: docker build -t app .
+      - uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: 'app'
+          severity: 'CRITICAL,HIGH'
+          exit-code: '1'
+      
+      # SARIF upload (GitHub Security tab)
+      - uses: github/codeql-action/upload-sarif@v3
+```
+
+### Custom Semgrep rule (prompt injection)
+```yaml
+# .semgrep/prompt-injection.yaml
+rules:
+  - id: llm-prompt-concat
+    pattern-either:
+      - pattern: |
+          $LLM.complete($PROMPT + $USER_INPUT)
+      - pattern: |
+          $LLM.complete(`...${$USER_INPUT}...`)
+    message: |
+      Prompt injection: user input concatenated. Use template / sanitize.
+    severity: ERROR
+    languages: [python, javascript, typescript]
+```
+
+### Pre-commit hook (secret + lint)
+```yaml
+# .pre-commit-config.yaml
+repos:
+  - repo: https://github.com/Yelp/detect-secrets
+    rev: v1.4.0
+    hooks:
+      - id: detect-secrets
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v4.5.0
+    hooks:
+      - id: trailing-whitespace
+      - id: check-yaml
+  - repo: local
+    hooks:
+      - id: lint
+        name: lint
+        entry: npm run lint
+        language: system
+```
+
+### SARIF (security findings format)
+```json
+{
+  "version": "2.1.0",
+  "runs": [{
+    "tool": { "driver": { "name": "MyScanner" } },
+    "results": [{
+      "ruleId": "sql-injection",
+      "level": "error",
+      "message": { "text": "SQL injection in users.ts:42" },
+      "locations": [{
+        "physicalLocation": {
+          "artifactLocation": { "uri": "src/users.ts" },
+          "region": { "startLine": 42 }
+        }
+      }]
+    }]
+  }]
+}
+```
+
+### Renovate (dep update + security)
+```json
+// renovate.json
+{
+  "extends": ["config:recommended", ":automergePatch"],
+  "vulnerabilityAlerts": {
+    "labels": ["security"],
+    "automerge": true
+  }
+}
+```
+
+## 🤔 결정 기준
+
+| Risk | Tool layer |
+|---|---|
+| Low (lint, style) | IDE / pre-commit |
+| Medium (SAST) | PR gate (Snyk / Sonar) |
+| High (CVE, secret) | PR block + alert |
+| Critical (zero-day) | Manual + emergency patch |
+| AI-generated code | Enhanced review |
+
+**기본값**: IDE + PR + pre-deploy 의 layered. 매 gate 의 different threshold.
+
+## 🔗 Graph
+- 부모: [[CI/CD Pipeline & IDE Security Integration|DevSecOps]] · [[AI_코드_리뷰]] · [[Security]]
+- 변형: [[SAST]] · [[보안 및 시스템 신뢰성 표준|DAST]] · [[Shift-Left-Security]]
+- 응용: [[CodeRabbit]] · [[Sonar]] · [[Semgrep]]
+- 매 OWASP: [[OWASP Top 10]]
+- Adjacent: [[Dependency-Update]] · [[Secret-Detection]]
+
+## 🤖 LLM 활용
+**언제**: 매 production system 의 security strategy. 매 vibe coding 의 review.
+**언제 X**: 매 throwaway script. Specific compliance audit (auditor).
+
+## ❌ 안티패턴
+- **AI 만 의존**: 매 architecture flaw miss.
+- **Manual 만**: 매 mechanical pattern miss.
+- **No quality gate**: 매 vulnerability 의 ship.
+- **Generic alert (no severity)**: alert fatigue.
+- **No secret scan + AI 의 hardcode**: leak.
+
+## 🧪 검증 / 중복
+- Verified.
+- 신뢰도 B.
+- Related: [[AI_코드_리뷰]] · [[AI-Code-Assurance]] · [[OWASP-API-Top-10]].
+
+## 🕓 Changelog
+| 날짜 | 변경 |
+|---|---|
+| 2026-05-08 | Phase 1 |
+| 2026-05-09 | Manual cleanup — shift-left + tool stack + code + 결정 |