你知道嗎：vibe coding 做的 app，資安要從哪裡顧起？幣安、永豐、91APP 都出事了

小屋技術白話課 03：資安基本常識 本集延伸文章：https://ginseng.dnplus.dev/ep/091 章節 00:00 被駭不可怕，說不出怎麼被駭才可怕 01:28 資安分成事前、事中、事後，還有三個 A 03:13 說不出怎麼被駭，為什麼可怕 03:45 總有人握著上線的鑰匙 04:19 幣安：虎符在自己人手上 05:20 永豐：破口在上游的供應商 05:54 91APP：出事拖累下游的品牌 06:37 社群罵翻了，出事後的反應其實還算得當 07:24 竊符救趙：符會被偷，對上了也要起疑 08:58 授權：現在到底有幾個人拿得到虎符 10:07 你就是那個店家 11:03 明天就能做的三件事 14:46 出事那天，你是哪一種身分 15:26 說得出怎麼被駭 來源 CISA：Mobile Communications Best Practice Guidance（2024/12，勿用簡訊當第二道驗證、改用 FIDO）: https://www.cisa.gov/sites/default/fi... Cloudflare：Application Security Report 2024 update（CVE-2024-27198 PoC 公開 22 分鐘後出現利用嘗試）: https://blog.cloudflare.com/applicati... Palo Alto Networks：2026 Unit 42 Global Incident Response Report（最快 72 分鐘到資料外洩）: https://www.paloaltonetworks.com/blog... RFC 2904：AAA Authorization Framework: https://www.rfc-editor.org/rfc/rfc2904 Microsoft Research：How effective is multifactor authentication at deterring cyberattacks?（arXiv 2305.00945）: https://arxiv.org/abs/2305.00945 Supabase Docs：Understanding API keys: https://supabase.com/docs/guides/api/... CNBC：Binance co-CEO Teng says hackers used fake job interviews to steal $6.3 billion in crypto: https://www.cnbc.com/2026/11/03/binan... Security Affairs：Binance hack: how fake job interviews and AI abuse led to a $6.34 billion attack: https://securityaffairs.com/202369/cy... The Block：Binance sees $3.64 billion in net outflows after reopening withdrawals: https://theblock.co/news/business/202... BleepingComputer：FBI links $6.3 billion Binance crypto heist to North Korean hackers: https://www.bleepingcomputer.com/news... 經濟日報：永豐銀新網銀遭盜轉: https://money.udn.com/money/story/561... 中央社：永豐銀網銀遭駭: https://www.cna.com.tw/news/afe/20261... TrendNews：91APP 資料外洩，最大可能影響約 480 萬名消費者: https://trendnews.surl.tw/article/904... 經濟日報：91APP 資安事件: https://money.udn.com/money/story/560... LINE TODAY（太報）：金管會對金融業三點期許: https://today.line.me/tw/v3/article/x... Zeabur：October 2026 Security Incident（初步報告）: https://zeabur.com/zh-TW/blogs/octobe... arXiv 2308.01074：A Practical Deep Learning-Based Acoustic Side Channel Attack on Keyboards: https://arxiv.org/abs/2308.01074 史記・魏公子列傳（維基文庫）: https://zh.wikisource.org/wiki/史記/卷077 NIST Cybersecurity Framework 2.0: https://csrc.nist.gov/pubs/cswp/29/th... Cyber Defense Matrix: https://cyberdefensematrix.com/ GitGuardian：State of Secrets Sprawl 2026: https://www.gitguardian.com/state-of-... GitHub Docs：About push protection: https://docs.github.com/en/code-secur... GitHub Docs：Reviewing your security log（90 天）: https://docs.github.com/en/authentica... GitHub Docs：Reviewing the audit log for your organization（180 天）: https://docs.github.com/en/organizati... Vercel Docs：Runtime Logs（保留時間）: https://vercel.com/docs/observability... Cloudflare Docs：Workers Logs（保留時間）: https://developers.cloudflare.com/wor... Supabase Pricing（Log retention）: https://supabase.com/pricing AWS CloudTrail：Event history（90 天）: https://docs.aws.amazon.com/awscloudt... OWASP Logging Cheat Sheet: https://cheatsheetseries.owasp.org/ch... NIST SP 800-61 Rev. 3：Incident Response Recommendations: https://csrc.nist.gov/pubs/sp/800/61/... 內政部警政署 165 全民防詐網: https://165.npa.gov.tw/ pstack（teach 技能）: https://github.com/cursor/plugins/tre... PA Cafe: https://pacafe.dnplus.dev