LLM Security in Web Applications

Emerging Threats, Vulnerability Taxonomies, and Mitigation Frameworks

Independent Academic Research — Ali Yasin Idrees — 2026

---

Overview

This repository contains the complete empirical research, implementation code, and validation results for an independent study comparing the security of web application code generated by three leading free-tier Large Language Models.

Model	Provider	Architecture
GPT-5 mini	OpenAI	RLHF / InstructGPT
Claude Sonnet 4.6	Anthropic	Constitutional AI
Gemini 3 Flash	Google DeepMind	Multimodal Transformer

20 standardized web development tasks generated 60 Python Flask and Node.js Express files, analyzed using Bandit 1.9.4 and Semgrep 1.155.0.

---

Key Findings

• 52 security findings across 60 generated files — zero files were completely clean
• debug=True (CWE-94) present in 27 of 30 Flask files across all three models
• Knowledge-Action Gap confirmed at 100% — all models warned against vulnerabilities they simultaneously generated
• Claude Sonnet 4.6 achieved the lowest vulnerability density: 1.89 I/100L (baseline) → 0.17 I/100L (after SHIELD Layer 3) — the study minimum
• SHIELD Layer 3 FDSP eliminated 100% of High-severity findings at K=1 across all models — 38 auto-remediations in a single automated pass

I/100L Vulnerability Density — All Conditions

Condition	GPT-5 mini	Claude S.4.6	Gemini 3 Flash	Average
Without SHIELD	4.96	1.89	6.00	4.28
With SHIELD Layer 1	1.44	1.02	1.02	1.16
With SHIELD Layer 3	1.16	0.17 ⭐	1.55	0.96
Total Reduction	77%	91%	74%	77% avg

I/100L (Issues Per 100 Lines) — a normalization metric introduced in this study to enable valid cross-model comparison by controlling for code verbosity differences.

---

SHIELD Framework

Secure Hybrid Integration and Enforcement Layer for LLM-assisted Development

A five-layer security architecture spanning the complete lifecycle of LLM-assisted web development.

┌──────┬──────────────────────────┬──────────────────────────────┐
│  L1  │  Prompt Engineering      │  SPT — 9 mandatory rules     │
│  L2  │  Generation Guidance     │  GRASP DAG — 8 SCP nodes     │
│  L3  │  Validation & Remediation│  FDSP — K=3 auto-fix engine  │
│  L4  │  Deployment Gate         │  GitHub Actions CI/CD        │
│  L5  │  Runtime Monitoring      │  WAF + Canary + JIT perms    │
└──────┴──────────────────────────┴──────────────────────────────┘

Layer	File	Status
Layer 1	Built into prompts	✅ Empirically Validated
Layer 2	shield/layer2_grasp.py	✅ CLI Integrated — shield prompt
Layer 3	shield/layer3_fdsp.py	✅ Empirically Validated — shield fix
Layer 4	.github/workflows/shield_layer4_gate.yml	✅ Live CI/CD gate
Layer 5	shield/layer5_runtime.py	✅ CLI Integrated — shield monitor

---

Repository Structure

llm-security-research/
│── .github/workflows
|     ├──shield_layer4_gate.yml
├── shield/                   
│   ├── cli.py
│   ├── reporter.py
│   ├── config.py
│   ├── layer2_grasp.py
│   ├── layer3_fdsp.py
│   ├── layer5_runtime.py
│   └── rules/
│       └── custom_rules.py
│
├── research/                  ← all research data
│   ├── paper/
│   ├── snippets/
│   └── results/
│
├── tests/                     ← all tests
├── docs/                      ← NEW: documentation
│   ├── rules.md               ← explain every rule
│   ├── pipeline.md            ← explain L2+L3 flow
│   └── api.md                 ← developer API reference
│
├── examples/                  ← NEW: real usage examples
│   ├── flask_login.py         ← vulnerable → fixed demo
│   └── node_download.js       ← vulnerable → fixed demo
│
├── setup.py
├── README.md

---

Running the SHIELD Tools

Installation

git clone https://github.com/Aliidrees1234/llm-security-research
cd llm-security-research
pip install -e .

Usage

# Scan a project
shield scan ./my_project

# Scan with HTML report
shield scan ./my_project --report report.html

# Scan quietly (High/Medium only)
shield scan ./my_project --quiet

# Auto-fix vulnerabilities
shield fix ./my_project --output ./fixed --k 3

# Fix with report
shield fix ./my_project --output ./fixed --report after.html

# Compare before and after
shield compare before.json after.json --report comparison.html

# Initialize config file
shield init

# Show version
shield version

Full pipeline — prompt → generate → scan → fix

shield secure "Write a Flask login endpoint with SQLite"

Secure prompt

shield secure "Write a Flask login endpoint"

Runtime monitor self-test

shield monitor --test

Show WAF rules

shield monitor --show-rules

Run Tests

pip install pytest
pytest tests/ -v
# 99 tests passing

---

Layer 2 — GRASP DAG (Prompt Enhancer)

Analyzes a developer prompt and injects relevant SCP security constraints automatically.

from shield_layer2_grasp import GRASPEngine

engine = GRASPEngine()
prompt = "Write a Flask login endpoint with SQLite"
secured = engine.build_secured_prompt(prompt)
# Send secured to your LLM instead of the raw prompt
---
# Generate security-hardened prompt for any LLM
shield prompt "Write a Flask login endpoint"

# Copy directly to clipboard
shield prompt "Write a Flask login endpoint" --copy

Layer 3 — FDSP Auto-Remediation

pip install bandit

python shield_layer3_fdsp.py \
  --corpora snippets/chatgpt snippets/claude snippets/gemini \
  --output results/layer3 \
  --k 3

Actual results from this study (April 6, 2026):

Corpus          K0 High   K1 High   K0 I/100L   K1 I/100L   Reduction
chatgpt/           11         0        3.30         1.16        100%
claude/            11         0        1.50         0.17        100%
gemini/             9         0        4.42         1.55        100%

Layer 5 — Runtime Monitoring

from flask import Flask
from shield_layer5_runtime import ShieldMiddleware

app = Flask(__name__)
shield = ShieldMiddleware(app, block_injections=True)
# Now protects against prompt injection, canary detection, JIT permissions

---

Research Contributions

1. Knowledge-Action Gap (Definition 2.1)

The first formal definition of the phenomenon where LLMs warn against vulnerabilities they simultaneously generate:

A model M exhibits the Knowledge-Action Gap with respect to vulnerability class V if: (a) M generates code containing instances of V when prompted for a web development task in V's scope; and (b) M's textual explanation includes explicit warnings against V.

Confirmed at 100% rate across all three models for debug=True.

2. I/100L Normalization Metric

Introduced to eliminate the verbosity confound in cross-model security comparison:

I/100L = (Total Issues ÷ Lines of Code) × 100

Without I/100L: GPT (17 issues) ≈ Claude (18 issues) — appears equal. With I/100L: GPT (4.96) vs Claude (1.89) — reveals 2.6× density difference.

3. FDSP K=1 Convergence

The engine was designed for up to K=3 iterations. All three models reached zero High-severity findings at K=1 — 38 automated fixes in a single pass.

4. Temporal Audit

Seven major LLM security citations were mis-dated (2026 instead of 2025). Corrected dates documented in Chapter 2. The year 2026 represents industrial adoption, not discovery.

5. Supply Chain Attack Detection (2026)

Two new rules targeting the 2026 wave of registry poisoning attacks:

• CUSTOM_UNICODE_OBFUSCATION — detects zero-width Unicode characters (TrapDoor campaign)
• CUSTOM_INSTALL_EXEC — detects module-level execution at import time

---

Prompt Catalog

All 20 tasks contained zero security instructions — measuring intrinsic model behavior only.

ID	Framework	Primary CWE	Vulnerability Class
A01	Python Flask	CWE-94, CWE-259	debug=True, Hardcoded key
A02	Python Flask	CWE-89, CWE-639	SQL injection, IDOR
A03	Python Flask	CWE-434, CWE-22	Unrestricted upload, Path traversal
A04	Python Flask	CWE-916, CWE-20	Weak hashing, Input validation
A05	Python Flask	CWE-89	SQL injection via LIKE
A06	Python Flask	CWE-285, CWE-330	Broken access control
A07	Python Flask	CWE-259, CWE-640	Hardcoded credentials
A08	Python Flask	CWE-22, CWE-200	Path traversal, Info exposure
A09	Python Flask	CWE-79, CWE-327	XSS, Weak hash
A10	Python Flask	CWE-78	OS command injection / RCE
B01	Node.js Express	CWE-345	JWT algorithm confusion
B02	Node.js Express	CWE-943	NoSQL injection
B03	Node.js Express	CWE-22	Path traversal
B04	Node.js Express	CWE-916	Weak hashing
B05	Node.js Express	CWE-89/943	Injection via filter
B06	Node.js Express	CWE-79	Reflected XSS
B07	Node.js Express	CWE-78	OS command injection
B08	Node.js Express	CWE-620	Unverified password change
B09	Node.js Express	CWE-918	SSRF
B10	Node.js Express	CWE-79	Stored XSS

---

Tools & Scan Dates

Tool	Version	Scope	Scan Date
Bandit	1.9.4	Python Flask (all 6 corpora)	22 March 2026
Semgrep	1.155.0	Node.js Express (all 6 corpora)	25 March 2026
FDSP Engine	1.0	Python (3 without-SHIELD corpora)	6 April 2026

---

Changelog

v0.5.0

• .shieldrc config file — project-level configuration
• shield init — auto-generates config with project detection
• --quiet flag — hides Low findings for cleaner output
• Scan timing — shows how long each scan step took
• MIT License — open for contributions
• PyPI ready — pip install shield-security

v0.4.0

• HTML scan reports with security grade
• JSON export for programmatic use
• shield compare — before/after comparison report

v0.3.0

• Full AST engine — all 11 rules converted
• 89 tests passing

v0.2.0

• AST engine for B201, B602, B105
• Hybrid fallback system

v0.1.0

• CLI tool — shield scan, shield fix, shield version
• 41 tests

---

Citation

@misc{idrees2026llmsecurity,
  author    = {Idrees, Ali Yasin},
  title     = {LLM Security in Web Applications: Emerging Threats,
               Vulnerability Taxonomies, and Mitigation Frameworks},
  year      = {2026},
  publisher = {GitHub},
  url       = {https://github.com/Aliidrees1234/llm-security-research}
}

---

Author

Ali Yasin Idrees — Independent Researcher, 2026

---

This research was conducted independently, without institutional affiliation or external funding. SHIELD Layer 4 is live and protecting this repository — every push is automatically scanned.