[Vox_Leone]

I have been using LLM to generate functional code from *pseudo-code* with excellent results. I am starting to experiment with UML diagrams, both with LLM and computer vision to actually generate code from UML diagrams; for example a simple activity diagram could be the prompt on LLM 's, and might look like:

Start -> Enter Credentials -> Validate -> [Valid] -> Welcome Message -> [Invalid] -> Error Message

Corresponding Code (Python Example):

class LoginSystem:

    def validate_credentials(self, username, password):
        if username == "admin" and password == "password":
            return True
        return False

    def login(self, username, password):
        if self.validate_credentials(username, password):
            return "Welcome!"
        else:
            return "Invalid credentials, please try again."

*Edited for clarity

[jonvk]

This example illustrates one of the risks of using LLMs without subject expertise though. I just tested this with claude and got that exact same validation method back. Using string comparison is dangerous from a security perspective [1], so this is essentially unsafe validation, and there was no warning in the response about this.

1. https://sqreen.github.io/DevelopersSecurityBestPractices/tim...

[jpc0]

Are you talking about the timing based attacks on that website which fails miserably at rendering a useable page on mobile?

[jpc0]

Could you add to the prompt that the password is stored in an sqlite database using argon2 for encryption, the encryption parameters are stored as environment variables.

You would like it to avoid timing based attacks as well as dos attacks.

It should also generate the functions as pure functions so that state is passed in and passed out and no side effects(printing to the console) happen within the function.

Then also confirm for me that it has handled all error cases that might reasonably happen.

While you are doing that, just think about how much implicit knowledge I just had to type into the comment here and that is still ignoring a ton of other knowledge that needs to be considered like whether that password was salted before being stored. All the error conditions for the sqlite implementation in python, the argon2 implementation in the library.

TLDR: that code is useless and would have taken me the same amount of time to write as your prompt.