Generative AI-Based Website Security Testing: Case Study of Educational Websites in Indonesia

The integration of Generative Artificial Intelligence (Generative AI) into educational websites has expanded digital service capabilities through chatbots and dynamic content systems. However, it has simultaneously introduced novel security vulnerabilities, such as prompt injection, data leakage, and insecure output handling, that remain insufficiently examined, particularly in the Indonesian context where rapid AI adoption outpaces security readiness. The research aims to develop and validate a hybrid security testing framework capable of detecting and mitigating vulnerabilities specific to Generative AI-based websites. The research adopts a Design Science Research (DSR) approach with an experimental mixed-methods strategy, combining quantitative security testing through penetration testing and adversarial red teaming with qualitative analysis based on threat modeling. The evaluation is conducted on Generative AI-enabled educational websites and simulated prototypes using Open Web Application Security Project (OWASP) Top 10 for Large Language Models (LLM) risk mapping, the Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege (STRIDE) framework, and adversarial benchmarks. The results indicate that dominant vulnerabilities are associated with prompt injection, information leakage, and insecure model output handling. The proposed framework significantly improves detection effectiveness with an accuracy rate of 92.6% while reducing attack success rates following layered remediation. These findings confirm that conventional web security mechanisms are insufficient for LLM-based systems and require adaptive, AI-specific testing approaches. The research contributes by strengthening the integration of AI security frameworks in the form of a new OWASP-STRIDE hybrid model and practically by providing actionable security testing guidance for developers and educational institutions seeking to deploy Generative AI more securely.