[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"article-black-duck-coverity-ai-era-triage-zh":3,"article-related-black-duck-coverity-ai-era-triage-zh":32,"series-industry-426b9a43-e4a1-4d1f-9386-540db4df1f70":77},{"id":4,"slug":5,"title":6,"content":7,"summary":8,"source":9,"source_url":10,"author":11,"image_url":12,"cover_image":12,"category":13,"language":14,"translated_content":11,"related_article_id":15,"keywords":16,"key_takeaways":25,"views":29,"created_at":30,"published_at":31,"topic_cluster_id":11},"426b9a43-e4a1-4d1f-9386-540db4df1f70","black-duck-coverity-ai-era-triage-zh","Coverity 5 項更新，AI 時代更好分流風險","\u003Cp>Black Duck Coverity 這次改了什麼，哪一項最值得 DevSecOps 團隊先上手？\u003C\u002Fp>\u003Cp data-speakable=\"summary\">Black Duck 更新 Coverity，重點是把 AI 掃描、風險排序和語言支援做得更完整。\u003C\u002Fp>\u003Ctable>\u003Cthead>\u003Ctr>\u003Cth>項目\u003C\u002Fth>\u003Cth>它補上的能力\u003C\u002Fth>\u003C\u002Ftr>\u003C\u002Fthead>\u003Ctbody>\u003Ctr>\u003Ctd>MCP server\u003C\u002Ftd>\u003Ctd>讓 AI coding agents 直接觸發本機 Coverity 掃描\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Security impact lens\u003C\u002Ftd>\u003Ctd>依安全優先度排序與篩選問題\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>IDOR checker\u003C\u002Ftd>\u003Ctd>找出 JavaScript 與 TypeScript 的 IDOR 漏洞\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>AI-assisted triage\u003C\u002Ftd>\u003Ctd>幫 C、C++ 掃描降低誤報噪音\u003C\u002Ftd>\u003C\u002Ftr>\u003Ctr>\u003Ctd>Rust support\u003C\u002Ftd>\u003Ctd>新增對 Rust 1.92 的支援\u003C\u002Ftd>\u003C\u002Ftr>\u003C\u002Ftbody>\u003C\u002Ftable>\u003Ch2>1. MCP server 讓 AI 工具先掃再寫\u003C\u002Fh2>\u003Cp>Black Duck 的 \u003Ca href=\"https:\u002F\u002Fwww.blackduck.com\u002F\">Black Duck\u003C\u002Fa> 為 \u003Ca href=\"https:\u002F\u002Fwww.blackduck.com\u002Fproducts\u002Fcoverity.html\">Coverity\u003C\u002Fa> 加入 \u003Ca href=\"\u002Ftag\u002Fmodel-context-protocol\">Model Context Protocol\u003C\u002Fa> server，讓 \u003Ca href=\"\u002Ftag\u002Fai-coding-agents\">AI coding agents\u003C\u002Fa> 能在開發流程中直接觸發本機安全與程式碼品質掃描。對團隊來說，重點不是多一個功能，而是把檢查提前到程式碼還在產生的時候。\u003C\u002Fp>\n\u003Cfigure class=\"my-6\">\u003Cimg src=\"https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785371567363-mk3t.png\" alt=\"Coverity 5 項更新，AI 時代更好分流風險\" class=\"rounded-xl w-full\" loading=\"lazy\" \u002F>\u003C\u002Ffigure>\n\u003Cp>公司也表示，這個整合可以配合團隊既有的 LLM 使用習慣，不必被綁定在單一 AI 產品上。這讓 Coverity 更像是接進 AI 工作流的檢查層，而不是另一個獨立工具。\u003C\u002Fp>\u003Cul>\u003Cli>AI agent 直接觸發本機掃描\u003C\u002Fli>\u003Cli>在寫碼當下就看到安全與品質回饋\u003C\u002Fli>\u003Cli>可配合不同 LLM 工作流\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>2. Security impact lens 先挑最該處理的問題\u003C\u002Fh2>\u003Cp>Coverity 新增的 security impact lens，目的是讓團隊依安全優先度來排序和篩選問題。文章提到，這類設計特別適合面對法規壓力的情境，例如歐盟 Cyber Resilience Act 這種要求更快回報與更嚴格處置的規範。\u003C\u002Fp>\u003Cp>它解決的不是「找不找得到 bug」，而是「先修哪個 bug」。對每天都被掃描結果淹沒的團隊來說，這種排序能力往往比再多幾條告警更有價值。\u003C\u002Fp>\u003Cul>\u003Cli>依安全優先度過濾\u003C\u002Fli>\u003Cli>適合合規導向的 triage\u003C\u002Fli>\u003Cli>掃描量大時特別有用\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>3. IDOR 檢查補上 Web 應用常見缺口\u003C\u002Fh2>\u003Cp>Black Duck 也替 JavaScript 和 \u003Ca href=\"\u002Ftag\u002Ftypescript\">TypeScript\u003C\u002Fa> 增加了 Insecure Direct Object Reference，也就是 IDOR 的檢查。這類漏洞常見於存取控制設計不嚴謹的應用，可能讓使用者看到本來不該看到的資料或操作。\u003C\u002Fp>\n\u003Cfigure class=\"my-6\">\u003Cimg src=\"https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785371569493-eptw.png\" alt=\"Coverity 5 項更新，AI 時代更好分流風險\" class=\"rounded-xl w-full\" loading=\"lazy\" \u002F>\u003C\u002Ffigure>\n\u003Cp>對做 Web 服務的團隊來說，這是很聚焦的補強，不是大而全的平台改版，而是直接瞄準一個常被忽略、但影響很實際的弱點。\u003C\u002Fp>\u003Cul>\u003Cli>支援 JavaScript\u003C\u002Fli>\u003Cli>支援 TypeScript\u003C\u002Fli>\u003Cli>鎖定 IDOR 類型漏洞\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>4. AI-assisted triage 幫 C 和 C++ 降噪\u003C\u002Fh2>\u003Cp>Coverity 這次也加入 AI-assisted issue triage，針對 C 和 C++ 掃描做更快的判讀。這很重要，因為這兩種語言的掃描結果常常又多又雜，團隊花在看告警的時間，有時比修正本身還久。\u003C\u002Fp>\u003Cp>這個更新不是要取代人工審查，而是先把明顯的噪音壓\u003Ca href=\"\u002Fnews\u002Fanthropic-opus-5-cheaper-ai-race-zh\">下來\u003C\u002Fa>。實務上，它能幫安全與開發團隊更快把注意力放在真正可能影響產品的缺陷上。\u003C\u002Fp>\u003Ccode>適合場景：C\u002FC++ 掃描告警很多\u003Cbr>主要收益：更快分出真缺陷與誤報\u003Cbr>目標：少花時間在低價值 triage\u003C\u002Fcode>\u003Ch2>5. Rust 1.92 支援讓工具鏈不掉隊\u003C\u002Fh2>\u003Cp>Black Duck 也補上了對 \u003Ca href=\"\u002Fnews\u002Frust-vs-go-2026-latency-gap-decoded-zh\">Rust\u003C\u002Fa> 1.92 的支援。對正在把 Rust 放進 production 的團隊來說，版本相容性很關鍵，因為靜態分析工具如果跟不上編譯器與語言特性，掃描就很容易卡住。\u003C\u002Fp>\u003Cp>這項更新看起來最不搶眼，但常常是決定工具能不能留在 CI\u002FCD 裡的那一項。只要你的程式碼有 \u003Ca href=\"\u002Ftag\u002Frust\">Rust\u003C\u002Fa>，版本支援就不是加分題，而是能不能持續掃描的門檻。\u003C\u002Fp>\u003Cul>\u003Cli>支援 Rust 1.92\u003C\u002Fli>\u003Cli>適合混合語言專案\u003C\u002Fli>\u003Cli>避免工具鏈升級後掃描中斷\u003C\u002Fli>\u003C\u002Ful>\u003Ch2>哪一項適合你\u003C\u002Fh2>\u003Cp>如果你們已經在用 \u003Ca href=\"\u002Ftag\u002Fai-coding\">AI coding\u003C\u002Fa> agents，MCP server 是最直接的升級，因為它把掃描放進寫碼流程裡。若團隊最大的痛點是告警太多、排序太慢，那就\u003Ca href=\"\u002Fnews\u002Fkimi-zhengyi-zui-gai-kan-dong-de-4-ge-dian-zh\">先看\u003C\u002Fa> security impact lens 和 AI-assisted triage。\u003C\u002Fp>\u003Cp>做 JavaScript、TypeScript、C、C++ 或 Rust 的團隊，則應先看語言相關更新。簡單說，想要 AI 整合選 MCP server，想要更快分流選 triage 與 impact lens，想要補漏洞盲點就看 IDOR 和 Rust 支援。\u003C\u002Fp>","5 項 Coverity 更新讓團隊更快分流風險、掃描 AI 程式碼，並補上 Rust 1.92 與 IDOR 檢查。","devops.com","https:\u002F\u002Fdevops.com\u002Fblack-duck-extends-scope-and-reach-of-code-scanning-tool\u002F",null,"https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785371567363-mk3t.png","industry","zh","159e13cc-8932-4ae4-a9b5-cf99b63e3e89",[17,18,19,20,21,22,23,24],"Black Duck","Coverity","AI triage","MCP server","IDOR","Rust 1.92","DevSecOps","static analysis",[26,27,28],"Coverity 這次更新的主軸是把 AI 工作流、風險排序和語言覆蓋補齊。","MCP server 最適合已經在用 AI coding agents 的團隊。","IDOR、AI-assisted triage 與 Rust 1.92 支援，分別對應 Web 安全、降噪與工具鏈相容性。",0,"2026-07-30T00:32:20.398854+00:00","2026-07-30T00:32:20.374+00:00",{"tags":33,"relatedLang":36,"relatedPosts":40},[34],{"name":20,"slug":35},"mcp-server",{"id":15,"slug":37,"title":38,"language":39},"black-duck-coverity-ai-era-triage-en","Black Duck’s Coverity gets better at AI-era triage","en",[41,47,53,59,65,71],{"id":42,"slug":43,"title":44,"cover_image":45,"image_url":45,"created_at":46,"category":13},"c8975000-183e-40a3-8166-f82e7df426f9","huang-open-letter-open-weight-ai-playbook-zh","黃仁勳把開放權重變成政策模板","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785378794029-2xws.png","2026-07-30T02:32:49.564763+00:00",{"id":48,"slug":49,"title":50,"cover_image":51,"image_url":51,"created_at":52,"category":13},"3eb8d253-88d2-4abb-8a20-d0cd2cbf8ec1","32-firms-back-open-weight-ai-dc-letter-zh","32 家公司挺開放權重 AI","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785376966978-w5h4.png","2026-07-30T02:02:24.180115+00:00",{"id":54,"slug":55,"title":56,"cover_image":57,"image_url":57,"created_at":58,"category":13},"93909597-d1e6-4dab-acb9-f57e677b3a1d","huang-shou-pian-x-wen-gong-kai-ting-kai-fang-quan-zhong-ai-zh","黃仁勳首篇 X 文，公開挺開放權重 AI","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785375182108-9blu.png","2026-07-30T01:32:35.493421+00:00",{"id":60,"slug":61,"title":62,"cover_image":63,"image_url":63,"created_at":64,"category":13},"2b6dff56-5978-4698-80ba-2c3495d568ff","anthropic-opus-5-cheaper-ai-race-zh","Opus 5 把 Anthropic 的企業 AI 價格打下來","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785369760529-sfd4.png","2026-07-30T00:02:19.796944+00:00",{"id":66,"slug":67,"title":68,"cover_image":69,"image_url":69,"created_at":70,"category":13},"de4b39d1-d20d-499f-bb98-657166136f6f","kimi-zhengyi-zui-gai-kan-dong-de-4-ge-dian-zh","Kimi蒸馏争议先看懂这4点","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785348180629-xanc.png","2026-07-29T18:02:31.12671+00:00",{"id":72,"slug":73,"title":74,"cover_image":75,"image_url":75,"created_at":76,"category":13},"ebfce0e6-3e54-4605-9acf-e7e55dfccd87","gemini-35-flash-lets-you-buy-speed-zh","Gemini 3.5 Flash 讓你買速度","https:\u002F\u002Fxxdpdyhzhpamafnrdkyq.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fcovers\u002Finline-1785312226012-g3yc.png","2026-07-29T08:03:13.916237+00:00",[78,83,88,93,98,103,108,113,118,123],{"id":79,"slug":80,"title":81,"created_at":82},"ee073da7-28b3-4752-a319-5a501459fb87","ai-in-2026-what-actually-matters-now-zh","2026 AI 真正重要的事","2026-03-26T07:09:12.008134+00:00",{"id":84,"slug":85,"title":86,"created_at":87},"83bd1795-8548-44c9-9a7e-de50a0923f71","trump-ai-framework-power-speech-state-preemption-zh","川普 AI 框架瞄準電力、言論與州權","2026-03-26T07:12:18.695466+00:00",{"id":89,"slug":90,"title":91,"created_at":92},"ea6be18b-c903-4e54-97b7-5f7447a612e0","nvidia-gtc-2026-big-ai-announcements-zh","NVIDIA GTC 2026 重點拆解","2026-03-26T07:14:26.62638+00:00",{"id":94,"slug":95,"title":96,"created_at":97},"4bcec76f-4c36-4daa-909f-54cd702f7c93","claude-users-spreading-out-and-getting-better-zh","Claude 用戶更分散，也更會用","2026-03-26T07:22:52.325888+00:00",{"id":99,"slug":100,"title":101,"created_at":102},"bd903b15-2473-4178-9789-b7557816e535","openclaw-raises-hard-question-for-ai-models-zh","OpenClaw 逼問 AI 模型價值","2026-03-26T07:24:54.707486+00:00",{"id":104,"slug":105,"title":106,"created_at":107},"eeac6b9e-ad9d-4831-8eec-8bba3f9bca6a","gap-google-gemini-checkout-fashion-search-zh","Gap 把結帳搬進 Gemini","2026-03-26T07:28:23.937768+00:00",{"id":109,"slug":110,"title":111,"created_at":112},"0740e53f-605d-4d57-8601-c10beb126f3c","google-pushes-gemini-transition-to-march-2026-zh","Google 把 Gemini 轉換延到 2026 年 3…","2026-03-26T07:30:12.825269+00:00",{"id":114,"slug":115,"title":116,"created_at":117},"e660d801-2421-4529-8fa9-86b82b066990","metas-llama-4-benchmark-scandal-gets-worse-zh","Meta Llama 4 分數風波又擴大","2026-03-26T07:34:21.156421+00:00",{"id":119,"slug":120,"title":121,"created_at":122},"183f9e7c-e143-40bb-a6d5-67ba84a3a8bc","accenture-mistral-ai-sovereign-enterprise-deal-zh","Accenture 攜手 Mistral AI 賣主權 AI","2026-03-26T07:38:14.818906+00:00",{"id":124,"slug":125,"title":126,"created_at":127},"191d9b1b-768a-478c-978c-dd7431a38149","mistral-ai-faces-its-hardest-year-yet-zh","Mistral AI 迎來最硬的一年","2026-03-26T07:40:23.716374+00:00"]