AI-Assisted Secure Coding (Appendix C) · AI Code-Review & Assistant Bot Hardening
Log review bot activity and watch egress
Verify that AI review and assistant bots log all prompts (including externally sourced context), tool calls, and outputs to tamper-evident storage. Egress patterns (URLs, IPs, DNS, payload sizes) are continuously monitored for exfiltration indicators, with alerting tuned for webhook, paste-site, and bin-service destinations.
OWASP AISVS v1.01, requirement AC.11.6
In plain English
Log everything bots receive and do, prompts, external context, tool calls and outputs, in tamper-evident storage, and watch their outbound traffic for signs of data theft.
What good looks like
- Full bot activity is logged.
- Logs are tamper-evident.
- Egress is monitored, with alerts for webhooks, paste sites and bin services.
How teams usually do it
- Central logging plus egress monitoring on bot runtimes.
Evidence an auditor would accept
- Log samples and alert rules.
Common mistakes
- Logging bot output but not the context it read.
Not sure which requirements apply to your system? Take the assessment.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.