AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Review bots treat PR content as untrusted
Verify that AI review and assistant bots treat every piece of PR-supplied content (diff, title, description, comments, file contents, commit messages, linked external URLs) as untrusted input, and apply the AISVS C2.1 prompt-injection defenses: instruction-hierarchy enforcement, content sanitization, and indirect-injection detection.
OWASP AISVS v1.01, requirement AC.11.1
In plain English
AI review and assistant bots must treat everything in a pull request as untrusted, including the diff, title, description, comments, file contents, commit messages and linked URLs, and apply prompt injection defences to it.
What good looks like
- All PR content is marked as untrusted data.
- Injection detection runs on it.
- The instruction hierarchy is enforced.
How teams usually do it
- The controls from section 2.1, applied in the bot integration.
Evidence an auditor would accept
- Bot configuration and injection test results.
Common mistakes
- Treating text in the diff as safe because it is "just code".
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.